PLACEHOLDER

Version 1.1

Release Date: 11/17/2025

Document Change History¶

This table documents all versions and changes made to this System Security Plan.

Document Maintenance¶

This System Security Plan (SSP) will be reviewed and updated at least annually to ensure continued accuracy and effectiveness. Reviews will be conducted whenever significant changes occur to the system architecture, security controls, organizational structure, threat environment, or regulatory requirements.

The annual review process includes assessment of:

• System owner changes

• Information security representative changes

• System architecture modifications

• Operational status updates

• System interconnection changes

• Scope modifications

• Authorizing official changes

• Certification and accreditation status

All updates will be documented in the revision history and require approval from the designated authorizing official before implementation.

Description of Document¶

This System Security Plan (SSP) documents the security controls and implementation details for the organization's CMMC Level 2 compliant environment designed to protect Controlled Unclassified Information (CUI) in accordance with NIST SP 800-171 Rev. 2 requirements. The SSP serves as the authoritative source for understanding the system's security architecture, control implementation, and operational procedures required to maintain the confidentiality of CUI while supporting the organization's mission objectives.

The SSP provides comprehensive documentation of:

• System boundaries and architecture defining the CMMC assessment scope, including all CUI assets, security protection assets, and contractor risk managed assets

• Security control implementation detailing how each of the 110 NIST SP 800-171 security requirements are satisfied through technical, administrative, and physical safeguards

• Inherited controls from FedRAMP-authorized cloud service providers (Microsoft Azure Government and Microsoft 365 GCC High) and managed service providers

Organization Description¶

Organization Information¶

System Description¶

System Information¶

System Description¶

The system is a cloud-native CMMC Level 2 secure enclave operating within Microsoft's Government Community Cloud High (GCC High) infrastructure, designed to protect Controlled Unclassified Information (CUI) in accordance with NIST SP 800-171 Rev. 2 requirements.

Environment description covers technical, management, and operational aspects with specific focus on CUI processing, storage, and transmission.

System Key Personnel¶

The following individuals are responsible for the security and management of the system:

System Owner¶

Serves as the system owner overseeing the CMMC service line, including implementation and oversight of applicable controls. Oversees resource management and provides executive approval for future client proposals. Acts as the primary point of contact for all external stakeholders, including CyberAB, DIBCAC, and other interested parties.

System Security Officer¶

Serves as the Director of Innovation and Technology, responsible for overseeing system owners and ensuring the implementation of firm-wide information security policies and practices. Provides strategic direction for cybersecurity, manages risk, ensures regulatory compliance, and leads incident response efforts. Also plays a key role in security governance and alignment of security initiatives with business objectives.

System Security Officer¶

Responsible for designing, implementing, and maintaining the organization's CMMC Level 2 compliant security architecture. The Security Administrator leads the security services support provided, maintains the System Security Plan and related documentation, and serves as the technical liaison during C3PAO assessments.

System & Data Flow Diagrams¶

System Boundary Diagram¶

System Boundary Diagram Description¶

This diagram illustrates the CMMC assessment boundary and data flow architecture for the organization's CUI environment, clearly delineating assets within scope and their interconnections. All CUI assets are hosted within FedRAMP-authorized Microsoft cloud services: Azure Government or Microsoft 365 GCC High. All Microsoft cloud services, whether they are CUI assets or not, can only be accessed from a Cloud PC

System Boundary Components¶

Azure Government Environment (Lower Section):

• Microsoft Entra ID (SPA) - Provides centralized authentication and identity management for all system access

• Cloud PC - CUI Users (CUI Asset) - Windows 365 Cloud PCs where authorized users process and access CUI

• Cloud PC - Security Team (CRMA) - Dedicated Windows 365 Cloud PCs for administrative access to Microsoft management portals, with no access to CUI components or data

• Microsoft Defender XDR (SPA) - Unified threat protection and security monitoring platform

• Intune (SPA) - Device management and compliance enforcement

• Privileged Identity Management (SPA) - Just-in-time administrative access control

• Microsoft Managed Network - Azure's underlying network infrastructure

Microsoft 365 GCC High Environment (Upper Right):

• SharePoint Online (CUI Asset) - Primary document repository for CUI storage

• Microsoft Teams (CUI Asset) - Collaboration platform for CUI communications

• OneDrive (CUI Asset) - Individual user CUI storage synchronized with Cloud PCs

• Exchange Online (CUI / CRMA) - Email services for users. This is a CUI asset for users who access CUI, and a CRMA asset for users who do not have access to CUI.

• Microsoft 365 Administration (SPA) - Administrative portal for service management

External Cloud Services

• HaloPSA (SPA) - ITSM platform for ticketing and compliance management, accessible directly from out-of-scope devices

• n8n (SPA) - Automation platform for security workflows, accessible directly from out-of-scope devices

• Huntress (SPA) – Provides managed endpoint protection (EDR), identity threat detection response (ITDR), and security event information (SIEM) services and serves as the security training platform

Out of Scope

• User Laptops (OOS) - Out-of-scope endpoints used to connect to Cloud PCs

Data Flow Descriptions

The diagram depicts six distinct data flows:

• CUI Data Flow (blue) - CUI-authorized users accessing CUI through dedicated Cloud PCs to M365 services

• SPA Data Flow (green) - Security team accessing administrative tools through CRMA Cloud PCs for Microsoft services, with direct access to external SPAs (HaloPSA/n8n)

• Administrative Data Flow (black) - Standard operational connections to HaloPSA for ticketing and Exchange for email. Exchange may only be accessed through a Cloud PC

• Authentication Flow (dotted) - Entra ID authentication for all access requests to the FedRAMP boundary

• Intra-Service Data Flow (orange dashed) - Communications between Microsoft services

• OOS VDI Access Flow (red) - Remote desktop connections from out-of-scope devices to both CUI and CRMA Cloud PCs

This architecture ensures complete CUI isolation within the FedRAMP-authorized Microsoft cloud services while segregating administrative access through dedicated CRMA Cloud PCs. Security personnel must access Microsoft administrative portals through their assigned CRMA Cloud PCs, preventing direct CUI access, while external management tools (HaloPSA and n8n) remain accessible directly for operational efficiency.

CUI Data Flow Diagram¶

CUI Data Flow Diagram Description¶

This diagram illustrates the specific data flow path for Controlled Unclassified Information (CUI) through the CMMC assessment boundary, demonstrating how CUI remains protected within the authorized environment.

CUI Flow Path¶

Entry Point: CUI-authorized users connect to the environment from out-of-scope laptops using Remote Desktop Protocol (RDP) to access their assigned Windows 365 Cloud PCs. The connection is authenticated through Microsoft Entra ID with conditional access policies enforcing MFA and device compliance checks. Only screen, keyboard, and mouse data traverse this connection—no CUI data can be copied or transferred to the local out-of-scope device.

CUI Processing Environment: Within the Azure Government boundary, Cloud PCs (marked as CUI assets) serve as the sole computing environment where users can view, create, and modify CUI. These STIG-hardened Windows 11 virtual desktops maintain complete data isolation, preventing unauthorized data exfiltration through disabled clipboard, file transfer, and printing capabilities to local devices.

CUI Assets: From the Cloud PCs, CUI flows exclusively to the authorized Microsoft 365 GCC High services:

• SharePoint Online - Primary repository for shared CUI documents and collaboration sites

• OneDrive - Individual user CUI storage with automatic synchronization to Cloud PCs

• Microsoft Teams - CUI shared through teams and channels, with files stored in underlying SharePoint libraries

• Exchange Online – Email services through which CUI may be transmitted.

Security Controls Along the Flow

The blue CUI data flow lines represent encrypted channels using FIPS 140-2 validated cryptographic modules, ensuring CUI protection in transit between Cloud PCs to Microsoft 365 services via TLS 1.2+ encryption.

Data Flow Isolation

The diagram clearly shows that CUI data flow (blue lines) is completely segregated from:

• Administrative data flows to management portals (SPA components)

• External service provider connections (HaloPSA and n8n)

• Security monitoring and compliance tools that only access metadata

This architecture ensures CUI remains within the FedRAMP High authorized boundary throughout its lifecycle, from creation to disposal, with no unauthorized pathways for data exfiltration.

SPA Data Flow Diagram¶

SPA Data Flow Diagram Description¶

This diagram illustrates the data flow paths for Security Protection Assets, showing how administrative and security tools are accessed without touching CUI data.

SPA Access Architecture¶

The green SPA data flow lines demonstrate a dual-access pattern for security and administrative tools:

1. Internal Microsoft SPAs: Security team members must connect through their dedicated CRMA Cloud PCs to access Microsoft administrative tools within the FedRAMP boundary

2. External SPAs: HaloPSA, n8n, and Huntress can be accessed directly from out-of-scope laptops without requiring Cloud PC connections as these assets are completely segregated from CUI data

SPA Components and Access Paths¶

Accessed via CRMA Cloud PC:

• Microsoft 365 Administration Portal - User and service management requiring FedRAMP boundary access

• Privileged Identity Management (PIM) - Just-in-time role elevation and access governance

• Microsoft Defender XDR - Security monitoring, threat hunting, and incident response

• Intune - Device configuration, compliance policies, and patch management

• Purview – Comprehensive data governance solution and includes capabilities such as applying sensitivity labels and data loss prevention policies

Accessed Directly or via Cloud PC:

• HaloPSA - ITSM platform for ticketing, change management, and compliance tracking

• n8n - Security automation workflows processing only technical metadata

• Huntress - Provides managed endpoint protection (EDR), identity threat detection response (ITDR), and security event information (SIEM) services and serves as the security training platform

Security Controls and Segregation¶

The SPA flow architecture enforces several key security principles:

• Security team members use separate CRMA Cloud PCs that cannot access CUI repositories

• All Microsoft administrative tools require authenticated Cloud PC sessions, ensuring audit trails remain within the FedRAMP boundary

• External SPAs operate completely outside the CUI processing environment with no data plane access

• Green flow lines never intersect with blue CUI data flows, maintaining complete segregation

Operational Workflow¶

Security administrators connect to their CRMA Cloud PCs via RDP, authenticate through Entra ID with enhanced MFA requirements, then access Microsoft administrative portals. For routine operations like ticket management in HaloPSA, security monitoring in Huntress, or automation development in n8n, direct laptop access is permitted since these services are logically separated from CUI and cannot access CUI data. This dual-access model balances security requirements with operational efficiency, ensuring administrative activities are logged and controlled within the FedRAMP boundary while allowing flexible access to external operational tools.

¶

Administrative Data Flow¶

¶

Administrative Data Flow Diagram Description¶

This diagram illustrates the administrative data flow paths for standard operational activities, showing how users perform non-CUI and administrative functions such as ticket management and email communications.

Administrative Access Patterns¶

Administrative functions follow distinct access requirements based on service location and data sensitivity:

1. External Service Access (HaloPSA): Users can connect directly to HaloPSA from out-of-scope laptops OR through their Cloud PCs for ticket management, change requests, and project tracking. This flexibility is permitted because HaloPSA operates outside the FedRAMP boundary and never processes CUI.

2. FedRAMP Service Access (Exchange): All access to Exchange Online and Microsoft 365 Administration Portal requires connection through Cloud PCs. Users access Exchange through their dedicated Cloud PCs.

Administrative Services¶

The black administrative flow lines connect to:

• HaloPSA (External SPA) - ITSM platform for viewing and managing tickets, tracking vulnerabilities, processing change requests, and managing compliance activities. Accessible from both out-of-scope laptops and Cloud PCs for operational flexibility.

• Exchange Online (CRMA) - Email and calendar services restricted to Cloud PC access only, ensuring organizational communications remain within the FedRAMP boundary.

Access Flow Description¶

For HaloPSA Access: Users can choose their access method based on convenience - either directly from laptops or through Cloud PCs. Both paths require Entra ID authentication. This dual-access model maximizes operational efficiency for non-CUI administrative tasks.

For Exchange Online Access: All users, including security team members, must access Exchange through their assigned Cloud PCs (CUI or CRMA). This ensures email communications, which may contain CUI references, remain within the FedRAMP authorized boundary.

Security Segregation¶

The architecture enforces clear boundaries:

• External administrative tools (HaloPSA) operate outside the FedRAMP boundary without CUI access

• Exchange Online, as a CRMA, is protected within the FedRAMP authorized boundary but segregated from primary CUI storage

• Security team's CRMA Cloud PCs provide access to Exchange without CUI exposure

This design balances operational efficiency for external tool access with strict boundary enforcement for FedRAMP services, ensuring all potentially sensitive communications remain within the controlled environment.

Intra-Service Data Flow¶

Intra-Service Data Flow Diagram Description¶

This diagram illustrates the internal service-to-service communications within the Microsoft cloud infrastructure, demonstrating the backend integrations that enable unified security, identity, and collaboration capabilities.

Microsoft-Managed Service Communications¶

The orange dashed lines represent automated data flows between Microsoft services that occur without direct user interaction. These backend communications are entirely managed by Microsoft within their FedRAMP-authorized infrastructure and are inherited controls from the cloud service provider.

Azure Government Service Integration

Within the Azure Government boundary, intra-service flows connect:

• Entra ID ↔ All Services: Provides authentication tokens and authorization decisions to every component

• Microsoft Defender XDR ↔ Intune: Shares device compliance status and threat detection signals for automated remediation

• Microsoft Defender XDR ↔ PIM: Monitors privileged account usage and detects anomalous administrative activities

• PIM ↔ Entra ID: Manages just-in-time role activations and privileged access governance

Microsoft 365 GCC High Integration

Within the M365 GCC High environment:

• Teams ↔ SharePoint: Teams stores all files in underlying SharePoint document libraries

• Teams ↔ Exchange: Calendar integration and presence information synchronization

• OneDrive ↔ SharePoint: Shared storage infrastructure and permission inheritance

• Microsoft 365 Admin Portal ↔ All M365 Services: Service configuration and user provisioning

• Purview ↔ All M365 Services: Purview has data governance over M365 services

Cross-Platform Integration

Between Azure Government and M365 GCC High:

• Entra ID ↔ M365 Services: Single sign-on authentication and conditional access policy enforcement

• Defender XDR ↔ M365 Services: Unified threat signals from email, collaboration, and endpoint security

External Service Integration

The diagram also shows intra-service flows to external SPAs:

• n8n ↔ HaloPSA: Automated ticket creation from security workflows

• n8n ↔ Defender XDR: Webhook-based vulnerability data extraction (metadata only)

• HaloPSA ↔ Entra ID: User synchronization between Entra ID and HaloPSA

Security and Compliance¶

All intra-service communications within the system boundary:

• Use Microsoft's internal service fabric with encryption in transit

• Are isolated from customer data planes using Microsoft Managed Networks

• Generate telemetry and audit logs aggregated in Defender XDR

• Inherit FedRAMP security controls for service-to-service authentication

This backend orchestration enables seamless user experiences—such as accessing Teams files through SharePoint permissions or automatic threat response across endpoints—while maintaining security boundaries and audit capabilities required for CMMC compliance.

System Assets Description¶

This section describes all system assets within the boundary. Components are organized by their asset scope classification, which determines the level of security controls applied and their role in protecting Controlled Unclassified Information (CUI).

CUI ASSETS¶

CUI Assets are system components where Controlled Unclassified Information (CUI) is processed, stored, or transmitted. These assets are subject to the full scope of NIST SP 800-171 controls and CMMC Level 2 requirements.

Cloud PC¶

Description¶

Windows 365 Cloud PC is a cloud-native Desktop-as-a-Service (DaaS) solution that serves as the primary CUI processing environment within the CMMC enclave. Each Cloud PC is a dedicated virtual machine running Windows 11 Enterprise in Microsoft's GCC High infrastructure, providing users with persistent, personalized desktops that maintain state between sessions while ensuring CUI remains within the FedRAMP-authorized boundary. Cloud PCs are configured as CUI Assets where authorized users directly access, process, and store Controlled Unclassified Information through Microsoft 365 applications. All CUI data remains encrypted at rest on the Cloud PC's managed disk, and users can only interact with CUI through the secure RDP session protected by TLS 1.2+ encryption.

Each Cloud PC is:

• STIG-hardened according to DoD Windows 11 security baselines

• Entra ID-joined with conditional access policies enforcing device compliance

• Intune-managed with automated configuration policies and security updates

• Defender-protected with real-time antimalware, firewall, and attack surface reduction rules

• DLP-enforced preventing unauthorized data exfiltration through clipboard, local drives, or USB redirection Cloud PCs enforce strict isolation where CUI-authorized users can only connect from compliant devices that meet conditional access requirements, including MFA authentication, known locations, and device health attestation. The Cloud PC architecture prevents data leakage by blocking all file transfers, clipboard operations, and printer redirection to the user's local device, ensuring CUI remains within the controlled environment while allowing only screen, keyboard, and mouse data to traverse the connection.

OneDrive¶

Description¶

OneDrive for Business provides individual CUI storage for each authorized user within the Microsoft 365 GCC High environment, functioning as a personal workspace that synchronizes with their Windows 365 Cloud PC. As a CUI Asset, OneDrive ensures that user files remain within the government cloud boundary while enabling offline access through the sync client with files encrypted on Cloud PCs and requiring Entra ID authentication for access.

SharePoint¶

Description¶

SharePoint Online (SPO) serves as the primary CUI document repository within Microsoft 365 GCC High, providing centralized document management and collaboration capabilities for the organization. As a designated CUI Asset, SharePoint hosts site collections with granular permissions enabling need-to-know access controls, version history tracking, and comprehensive audit logging of all CUI interactions. The platform enforces Microsoft Purview DLP policies and sensitivity labels at the document library level, preventing unauthorized external sharing while maintaining full text search capabilities across CUI content for authorized users within the FedRAMP High boundary.

Teams¶

Description¶

Microsoft Teams enables secure collaboration and communication for CUI-authorized users within the GCC High environment, providing persistent chat, video conferencing, and file sharing capabilities required for organizational operations. As a CUI Asset, Teams stores all shared files in underlying SharePoint document libraries, ensuring consistent security controls and retention policies across all CUI communications.

Exchange Online¶

Description¶

Exchange Online provides secure email, calendar, and contact management services for CUI-authorized users within the GCC High environment. As a CUI Asset, Exchange Online ensures that CUI user communications—including messages and attachments that may contain Controlled Unclassified Information—are transmitted and stored within the FedRAMP High authorized boundary. Exchange enforces encryption for data at rest and in transit, applies Microsoft Purview Data Loss Prevention (DLP) policies, and integrates with Defender for Office 365 to protect against phishing and malware. All access to Exchange Online is restricted to compliant Cloud PC sessions, maintaining strict isolation and consistent security controls across all CUI communications.

SECURITY PROTECTION ASSETS (SPA)¶

Security Protection Assets (SPA) are components that provide security functions, monitoring, or protection capabilities for the CUI environment but do not directly process, store, or transmit CUI. These assets support the implementation of security controls.

HaloPSA¶

Description¶

HaloPSA is a cloud-based IT Service Management (ITSM) platform that serves as a Security Protection Asset (SPA) for managing the administrative and compliance functions of the CMMC environment without processing or accessing CUI. The platform provides centralized ticketing for incident and change management, user access requests and service requests, and is also where security documentation is stored.

Huntress¶

Description¶

Huntress is a managed security platform operating as a Security Protection Asset (SPA) that provides comprehensive endpoint, identity, and log management protection through three integrated services: Managed Endpoint Detection and Response (EDR), Managed Identity Threat Detection and Response (ITDR), and Managed Security Information and Event Management (SIEM). All services are backed by a 24/7 human-led, AI-assisted Security Operations Center (SOC) that provides continuous threat hunting, investigation, and actionable remediation guidance without accessing or processing CUI data.

Managed EDR combines machine analysis with expert threat hunters who review suspicious activities, investigate anomalies, and provide remediation guidance. Unlike traditional EDR solutions relying solely on automated detection, Huntress specializes in detecting post-exploitation activities and persistent threats that evade conventional security tools by:

• Persistent foothold detection identifying backdoors, web shells, and unauthorized remote access tools

• Ransomware canaries deploying decoy files that trigger immediate alerts upon encryption attempts

• External recon detection monitoring for exposed RDP, VNC, and other remote access services

• Process behavior analysis identifying living-off-the-land techniques and fileless malware

• Managed remediation with SOC analysts providing step-by-step removal instructions or automated isolation

Managed ITDR integrates with Microsoft 365 and Microsoft Entra ID to protect cloud identities and prevent business email compromise by monitoring:

• Account takeovers through suspicious login locations, VPN anomalies, and credential theft detection

• Session hijacking identifying stolen authentication tokens that bypass MFA/2FA

• Rogue OAuth applications exploiting Microsoft's OAuth protocol for unauthorized access

• Malicious inbox rules and mail forwarding configurations used for data exfiltration

• Identity risk assignment and automated identity isolation when compromise is detected

Managed SIEM collects and analyzes security-relevant log data through Smart Filtering technology that reduces noise while retaining critical security events:

• Windows Security Event Logs from endpoints and Cloud PCs including authentication, process creation, and PowerShell script execution events

• Identity and authentication logs from Microsoft 365 and other cloud services

• Compliance-ready data retention with powerful search and reporting capabilities

The platform also delivers comprehensive security awareness training including:

• Role-based training modules covering CUI handling, insider threats, password security, and incident reporting

• Automated enrollment and tracking ensuring all users complete initial and annual refresher training

Huntress deploys via lightweight agents on Windows 365 Cloud PCs, integrates with Microsoft Defender for defense-in-depth coverage, and generates alerts that flow into HaloPSA ticketing for centralized incident management and response tracking.

Intune¶

Description¶

Microsoft Intune is a cloud-based endpoint management service operating as a Security Protection Asset (SPA) that enforces security configurations, compliance policies, and automated remediation across all Windows 365 Cloud PCs in the CMMC environment. Intune enables centralized device management through the Microsoft Endpoint Manager admin center, ensuring all Cloud PCs maintain STIG-compliant configurations while automatically deploying security updates and approved applications without requiring user intervention.

Intune provides:

• Configuration profiles enforcing BitLocker encryption, Windows Firewall rules, and attack surface reduction policies required for CUI protection

• Compliance policies continuously evaluating device health against security baselines with automatic remediation or access blocking for non-compliant devices

• Windows Update for Business orchestrating monthly security patches and feature updates within defined maintenance windows

• Application deployment managing allowlisted software while blocking unauthorized application installation

Microsoft Defender XDR¶

Description¶

Microsoft Defender XDR (Extended Detection and Response) serves as the unified threat protection platform and security operations center for the CMMC environment, operating as a Security Protection Asset (SPA) that provides comprehensive visibility across endpoints, identities, email, and cloud applications. Defender XDR correlates signals from Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps to detect sophisticated attacks, automatically contain threats, and provide AI-powered investigation capabilities that dramatically reduce mean time to respond (MTTR).

The platform delivers:

• Automated investigation and response that contains compromised accounts, isolates infected devices, and remediates malicious emails without manual intervention

• Advanced hunting with KQL (Kusto Query Language) enabling proactive threat hunting across raw security data

• Unified incident queue correlating alerts across all Defender products into prioritized incidents with full kill chain visibility

• Vulnerability management continuously assessing Cloud PCs for missing patches, misconfigurations, and security recommendations with risk-based prioritization

Microsoft Entra ID¶

Description¶

Microsoft Entra ID is a Security Protection Asset (SPA) and is Microsoft's cloud-based directory and identity management service providing centralized authentication and authorization for the CMMC environment. Entra ID combines core directory services, advanced identity governance, and application access management while offering a rich, standards-based platform that enables developers to deliver access control to their applications based on centralized policy and rules.

Entra ID enforces Conditional Access policies that evaluate user sign-in requests in real-time, requiring multi-factor authentication, device compliance checks, and trusted location verification before granting access to CUI resources. These risk-based policies automatically block or challenge suspicious login attempts, enforce session controls for privileged accounts, and restrict access to SharePoint, OneDrive, and Teams based on device trust levels, ensuring only authorized users on managed, compliant devices can access CUI within the GCC High boundary.

Microsoft Purview¶

Description¶

Microsoft Purview serves as the data governance and compliance platform within Microsoft 365 GCC High, operating as a Security Protection Asset (SPA) that provides information protection and data loss prevention capabilities for CUI handling. Purview enables the organization to classify, protect, and monitor sensitive data across SharePoint, OneDrive, Teams, and Exchange within the GCC High environment.

Microsoft 365 Administration¶

Description¶

Microsoft 365 Administration is a cloud-based administrative platform that serves as a Security Protection Asset (SPA) for managing user identities, permissions, and license assignments across the Microsoft 365 environment without processing or accessing CUI. The platform provides centralized administration through the Microsoft 365 Admin Center and Azure Entra ID for provisioning user accounts, assigning software licenses, configuring role-based access controls, and managing security group memberships. Administrative functions include user lifecycle management (onboarding/offboarding), license allocation for Office 365 and Microsoft Teams, and permission delegation for organizational resources.

n8n¶

Description¶

n8n is an open-source workflow automation platform operating as a Security Protection Asset (SPA) that orchestrates security and compliance processes without accessing or processing CUI data. The platform provides a visual workflow builder with custom integrations for Microsoft Graph API, HaloPSA, and external threat intelligence sources, enabling automated data flows between security protection assets. n8n's primary function involves: Automated data extraction from Microsoft Defender XDR via Graph API webhooks, retrieving only technical metadata (device IDs, CVE numbers, severity ratings) Threat intelligence enrichment cross-referencing vulnerabilities against CISA Known Exploited Vulnerabilities (KEV) catalog for risk prioritization Ticket generation in HaloPSA with remediation timelines based on CVSS scores and exploitability metrics Status synchronization updating tickets when Defender reports successful patch deployment or remediation completion

Privileged Identity Management¶

Description¶

Privileged Identity Management (PIM) is an Azure Entra ID service operating as a Security Protection Asset (SPA) that provides just-in-time privileged access to Azure Government and Microsoft 365 GCC High administrative roles. PIM eliminates standing administrative privileges by requiring eligible administrators to request and justify role activation for time-bounded periods, typically 4-8 hours, with MFA verification before elevation.

Key Capabilities:

• On-demand role activation requiring business justification for sensitive administrative functions

• Time-limited access automatically removing privileges after the specified duration expires

• Audit history maintaining comprehensive logs of all role activations and configuration changes

PIM directly supports CMMC access control requirements by ensuring privileged accounts are only active when necessary and maintaining separation between standard user access and administrative functions. The service integrates with Microsoft Defender XDR to detect anomalous privileged account usage and generates compliance reports demonstrating just-in-time access patterns for audit evidence.

CONTRACTOR RISK MANAGED ASSETS (CRMA)¶

Contractor Risk Managed Assets (CRMA) are components that have the technical capability to process CUI but are managed through policies, procedures, and technical controls to prevent CUI access or storage. These assets require ongoing monitoring to ensure they do not inadvertently process CUI.

Cloud PC¶

Description¶

Windows 365 Cloud PC is a cloud-native Desktop-as-a-Service (DaaS) solution that serves as an administrative platform within the CMMC enclave. Each Cloud PC is a dedicated virtual machine running Windows 11 Enterprise in Microsoft's GCC High infrastructure, providing administrators with persistent, personalized desktops that maintain state between sessions while operating within the FedRAMP-authorized boundary. For security/administrative users who do not access CUI, Cloud PCs are configured as Contractor Risk Managed Assets (CRMA) that have the technical capability but are not intended to process, store, or transmit Controlled Unclassified Information. Administrative users utilize these Cloud PCs for tenant management, security administration, and infrastructure tasks, with technical controls and policies preventing access to CUI repositories in OneDrive, SharePoint, and Teams. Each Cloud PC is:

• STIG-hardened according to DoD Windows 11 security baselines

• Entra ID-joined with conditional access policies enforcing device compliance

• Intune-managed with automated configuration policies and security updates

• Defender-protected with real-time antimalware, firewall, and attack surface reduction rules

• DLP-enforced preventing unauthorized data movement through clipboard, local drives, or USB redirection Cloud PCs enforce strict isolation where administrative users can only connect from compliant devices that meet conditional access requirements, including MFA authentication, known locations, and device health attestation. The Cloud PC architecture includes security controls blocking file transfers, clipboard operations, and printer redirection to the user's local device, while administrative access is restricted through role-based permissions and policies that prevent CUI access. Only screen, keyboard, and mouse data traverse the connection, with audit logging monitoring all administrative actions for compliance verification.

Exchange Online¶

¶

Description¶

Exchange Online (EXO) provides enterprise email, calendar, and contact management services within the Microsoft 365 GCC High environment, serving as a Contractor Risk Managed Asset (CRMA) in the CMMC boundary. Exchange enforces transport-layer encryption using TLS 1.2+ for all mail flow, implements Microsoft Defender for Office 365 anti-phishing and safe attachments scanning, and applies Purview DLP policies to detect and prevent unauthorized CUI transmission via email.

Control Implementations¶

1. ACCESS CONTROL (AC)¶

Control 3.1.1: Limit System Access to Authorized Users¶

Control Summary¶

Control Objectives¶

Control 3.1.2: Limit System Access to Types of Transactions and Functions¶

Control Summary¶

Control Objectives¶

Control 3.1.3: Control the Flow of CUI¶

Control Summary¶

Control Objectives¶

Control 3.1.4: Separate Duties of Individuals¶

Control Summary¶

Control Objectives¶

Control 3.1.5: Employ the Principle of Least Privilege¶

Control Summary¶

Control Objectives¶

Control 3.1.6: Use Non-Privileged Accounts¶

Control Summary¶

Control Objectives¶

Control 3.1.7: Prevent Non-Privileged Users from Executing Privileged Functions¶

Control Summary¶

Control Objectives¶

Control 3.1.8: Limit Unsuccessful Logon Attempts¶

Control Summary¶

Control Objectives¶

Control 3.1.9: Provide Privacy and Security Notices¶

Control Summary¶

Control Objectives¶

Control 3.1.10: Use Session Lock with Pattern-Hiding Displays¶

Control Summary¶

Control Objectives¶

Control 3.1.11: Terminate User Sessions¶

Control Summary¶

Control Objectives¶

Control 3.1.12: Monitor and Control Remote Access Sessions¶

Control Summary¶

Control Objectives¶

Control 3.1.13: Employ Cryptographic Mechanisms¶

Control Summary¶

Control Objectives¶

Control 3.1.14: Control Access to Wireless Networks¶

Control Summary¶

Control Objectives¶

Control 3.1.15: Authorize Wireless Access¶

Control Summary¶

Control Objectives¶

Control 3.1.16: Authorize Wireless Access¶

Control Summary¶

Control Objectives¶

Control 3.1.17: Protect Wireless Access¶

Control Summary¶

Control Objectives¶

Control 3.1.18: Encrypt CUI on Mobile Devices¶

Control Summary¶

Control Objectives¶

Control 3.1.19: Control Connection of Mobile Devices¶

Control Summary¶

Control Objectives¶

Control 3.1.20: Control CUI Posting or Processing on Publicly Accessible Systems¶

Control Summary¶

Control Objectives¶

Control 3.1.21: Authorize Access to Publicly Accessible Systems¶

Control Summary¶

Control Objectives¶

Control 3.1.22: Control Public Information¶

Control Summary¶

Control Objectives¶

2. AWARENESS AND TRAINING (AT)¶

Control 3.2.1: Ensure Managers, System Administrators, and Users are Aware¶

Control Summary¶

Control Objectives¶

Control 3.2.2: Ensure Personnel are Trained¶

Control Summary¶

Control Objectives¶

Control 3.2.3: Provide Security Awareness Training on Recognizing Insider Threats¶

Control Summary¶

Control Objectives¶

3. AUDIT AND ACCOUNTABILITY (AU)¶

Control 3.3.1: Create and Retain Audit Records¶

Control Summary¶

Control Objectives¶

Control 3.3.2: Ensure Actions Can Be Traced to Users¶

Control Summary¶

Control Objectives¶

Control 3.3.3: Review and Update Audit Events¶

Control Summary¶

Control Objectives¶

Control 3.3.4: Alert in the Event of an Audit Logging Process Failure¶

Control Summary¶

Control Objectives¶

Control 3.3.5: Correlate Audit Record Review, Analysis, and Reporting¶

Control Summary¶

Control Objectives¶

Control 3.3.6: Provide Audit Reduction and Report Generation¶

Control Summary¶

Control Objectives¶

Control 3.3.7: Provide a System Capability that Compares Audit Records¶

Control Summary¶

Control Objectives¶

Control 3.3.8: Protect Audit Information and Audit Logging Tools¶

Control Summary¶

Control Objectives¶

Control 3.3.9: Limit Management of Audit Logging to Privileged Users¶

Control Summary¶

Control Objectives¶

4. CONFIGURATION MANAGEMENT (CM)¶

Control 3.4.1: Establish and Maintain Baseline Configurations¶

Control Summary¶

Control Objectives¶

Control 3.4.2: Establish and Enforce Security Configuration Settings¶

Control Summary¶

Control Objectives¶

Control 3.4.3: Track, Review, Approve or Disapprove Changes¶

Control Summary¶

Control Objectives¶

Control 3.4.4: Analyze Impact of Changes¶

Control Summary¶

Control Objectives¶

Control 3.4.5: Define, Document, Approve, and Enforce Access Restrictions¶

Control Summary¶

Control Objectives¶

Control 3.4.6: Employ Principle of Least Functionality¶

Control Summary¶

Control Objectives¶

Control 3.4.7: Restrict, Disable, or Prevent Software¶

Control Summary¶

Control Objectives¶

Control 3.4.8: Apply Deny-by-Exception Policy to Software¶

Control Summary¶

Control Objectives¶

Control 3.4.9: Control and Monitor User-Installed Software¶

Control Summary¶

Control Objectives¶

5. IDENTIFICATION AND AUTHENTICATION (IA)¶

Control 3.5.1: Identify System Users¶

Control Summary¶

Control Objectives¶

Control 3.5.2: Authenticate Users¶

Control Summary¶

Control Objectives¶

Control 3.5.3: Use Multifactor Authentication¶

Control Summary¶

Control Objectives¶

Control 3.5.4: Employ Replay-Resistant Authentication Mechanisms¶

Control Summary¶

Control Objectives¶

Control 3.5.5: Prevent Reuse of Identifiers¶

Control Summary¶

Control Objectives¶

Control 3.5.6: Disable Identifiers After a Defined Period¶

Control Summary¶

Control Objectives¶

Control 3.5.7: Enforce a Minimum Password Complexity¶

Control Summary¶

Control Objectives¶

Control 3.5.8: Prohibit Password Reuse¶

Control Summary¶

Control Objectives¶

Control 3.5.9: Allow Temporary Password Use¶

Control Summary¶

Control Objectives¶

Control 3.5.10: Store and Transmit Passwords¶

Control Summary¶

Control Objectives¶

Control 3.5.11: Obscure Feedback of Authentication Information¶

Control Summary¶

Control Objectives¶

6. INCIDENT RESPONSE (IR)¶

Control 3.6.1: Establish an Operational Incident-Handling Capability¶

Control Summary¶

Control Objectives¶

Control 3.6.2: Track, Document, and Report Incidents¶

Control Summary¶

Control Objectives¶

Control 3.6.3: Test the Incident Response Capability¶

Control Summary¶

Control Objectives¶

7. MAINTENANCE (MA)¶

Control 3.7.1: Perform Maintenance on Systems¶

Control Summary¶

Control Objectives¶

Control 3.7.2: Provide Controls on Tools¶

Control Summary¶

Control Objectives¶

Control 3.7.3: Ensure Equipment Removed for Off-Site Maintenance is Sanitized¶

Control Summary¶

Control Objectives¶

Control 3.7.4: Check Media with Diagnostic and Test Programs for Malicious Code¶

Control Summary¶

Control Objectives¶

Control 3.7.5: Require Multifactor Authentication for Remote Maintenance¶

Control Summary¶

Control Objectives¶

Control 3.7.6: Supervise Maintenance Personnel¶

Control Summary¶

Control Objectives¶

8. MEDIA PROTECTION (MP)¶

Control 3.8.1: Protect System Media¶

Control Summary¶

Control Objectives¶

Control 3.8.2: Limit Access to Media to Authorized Users¶

Control Summary¶

Control Objectives¶

Control 3.8.3: Sanitize or Destroy System Media¶

Control Summary¶

Control Objectives¶

Control 3.8.4: Mark Media¶

Control Summary¶

Control Objectives¶

Control 3.8.5: Control Access and Maintain Accountability During Transport¶

Control Summary¶

Control Objectives¶

Control 3.8.6: Implement Cryptographic Mechanisms to Protect CUI on Portable Storage¶

Control Summary¶

Control Objectives¶

Control 3.8.7: Control Use of Removable Media¶

Control Summary¶

Control Objectives¶

Control 3.8.8: Prohibit Use of Portable Storage¶

Control Summary¶

Control Objectives¶

Control 3.8.9: Protect Backups of CUI¶

Control Summary¶

Control Objectives¶

9. PERSONNEL SECURITY (PS)¶

Control 3.9.1: Screen Individuals¶

Control Summary¶

Control Objectives¶

Control 3.9.2: Ensure CUI and Systems are Protected During and After Personnel Actions¶

Control Summary¶

Control Objectives¶

10. PHYSICAL PROTECTION (PE)¶

Control 3.10.1: Limit Physical Access to Systems¶

Control Summary¶

Control Objectives¶

Control 3.10.2: Protect and Monitor Physical Facility¶

Control Summary¶

Control Objectives¶

Control 3.10.3: Escort Visitors and Monitor Visitor Activity¶

Control Summary¶

Control Objectives¶

Control 3.10.4: Maintain Audit Logs of Physical Access¶

Control Summary¶

Control Objectives¶

Control 3.10.5: Control and Manage Physical Access Devices¶

Control Summary¶

Control Objectives¶

Control 3.10.6: Enforce Safeguarding Measures for CUI¶

Control Summary¶

Control Objectives¶

11. RISK ASSESSMENT (RA)¶

Control 3.11.1: Periodically Assess Risk¶

Control Summary¶

Control Objectives¶

Control 3.11.2: Scan for Vulnerabilities¶

Control Summary¶

Control Objectives¶

Control 3.11.3: Remediate Vulnerabilities¶

Control Summary¶

Control Objectives¶

12. SECURITY ASSESSMENT (CA)¶

Control 3.12.1: Periodically Assess Security Controls¶

Control Summary¶

Control Objectives¶

Control 3.12.2: Develop and Implement Plans of Action¶

Control Summary¶

Control Objectives¶

Control 3.12.3: Monitor Security Controls on an Ongoing Basis¶

Control Summary¶

Control Objectives¶