For defense contractors · Microsoft 365 commercial or GCC
Microsoft 365 Hardening
Four weekly working sessions that put your Microsoft 365 tenant in the right order for CMMC Level 2: a defensible boundary for controlled unclassified information (CUI), the settings that matter most, the requirements no tenant setting covers, and evidence an assessor can follow. Your own admin makes every change. ForgePoint holds no accounts in your tenant and never sees CUI.
Starting price
$5,000, with $2,500 credited toward your Assessment if booked within 60 days
For Microsoft 365 commercial and GCC tenants.
Final scope and price are confirmed in a written SOW after discovery.
Who it's for
- Your email, files and identity live in a Microsoft 365 commercial or GCC tenant.
- You handle, or expect to handle, CUI under a defense contract.
- You already pay for Microsoft 365 security features and want them switched on in the right order.
- Your admin or MSP can make changes, but needs to know which ones, in what order, and what evidence to keep.
- You're the contractor. It's sold to contractors only; your MSP can attend as your hands.
Questions it answers
- Is this tenant the right home for our CUI?
- Which changes come first, and which can wait?
- Which NIST SP 800-171 requirements does each change support?
- Which requirements does no tenant setting cover?
- What evidence should we keep, and where?
Deliverables
What you receive
- 01
Tenant snapshot
Cloud (commercial or GCC), licences, admin model, where CUI lives today, and a first-draft CUI boundary sketch. - 02
"Right home for CUI?" finding
A plain statement of whether this tenant suits your CUI, with reasons and sources. - 03
Prioritised fix list
Kept in your tenant, each row tagged with the NIST SP 800-171 requirements it supports. - 04
Change log
Every change your admin made, with date, approver and rollback step. - 05
Before-and-after results
Microsoft Secure Score and CISA ScubaGear, run by you in your tenant: a by-product, never a compliance score. - 06
Evidence checklist
For each requirement touched: what to export, where it lives and how often to refresh it. - 07
Manual-requirements list
The requirements no tenant setting satisfies (policies, training, physical, personnel, incident response). - 08
Readout
What changed, what's left, and a proposal for the Level 2 Readiness Assessment.
How it runs
The engagement, step by step
- 01
Pre-flight
A checklist for your admin a week before session 1: licences, roles, features and break-glass accounts. - 02
Week 1
Snapshot, boundary sketch and the "right home for CUI?" finding, then identity and admin access. - 03
Week 2
Email protection, sharing and guest access, and app consent. - 04
Week 3
Devices: enrolment, compliance, configuration, encryption and endpoint protection. - 05
Week 4
Labels, data loss prevention, audit logging, alerting, the evidence checklist and the readout.
Typical timeline
Pre-flight + 4 weeks
One 60–90 minute session a week, hosted in your own Teams. The first session date is confirmed in writing in your SOW.
Not included
- A certification decision, a guaranteed assessment result or an official assessment. ForgePoint is a readiness advisor, not a C3PAO.
- Legal interpretation of contracts, DFARS clauses or CUI markings.
- Accounts, access or changes in your tenant. Your admin, or your MSP on your instructions, makes every change.
- Recordings, CUI or evidence files sent to ForgePoint.
- Tenant migration (including to GCC High), and GCC High, Google Workspace, AWS or Google Cloud hardening.
- An SPRS score or an assessment. This is not a Level 2 self-assessment.
- SSP, POA&M or policy writing. That is the SSP & POA&M Buildout.
- Buying, deploying or configuring third-party tools, and CIS Benchmark content.
- Endpoints and systems outside the tenant. They are recorded as gaps, not hardened.
Watch: 4 minutes
Microsoft 365 Hardening, explained.
NIST SP 800-171 Rev. 2
What each session supports.
Each row lists the NIST SP 800-171 Rev. 2 requirements the work supports. None of them, alone or together, means a requirement is met: that is decided against all of a requirement's assessment objectives, usually with policy, procedure and evidence that no setting provides.
| When | Work | Supports | Microsoft 365 feature | Licence | Evidence you keep |
|---|---|---|---|---|---|
| Pre-flight | Checklist for your admin: licences, roles, feature presence, break-glass status, change-window owner | Preparation | Microsoft 365 admin center reports | Any | Completed checklist (you keep it) |
| Week 1 | Snapshot: cloud, licences, admins, where CUI lives, first boundary sketch; you run ScubaGear and record Secure Score | 3.4.1, 3.12.1, 3.12.4 (input) | Microsoft 365 admin center, Microsoft Secure Score, CISA ScubaGear | Any | Licence export, ScubaGear report, Secure Score snapshot |
| Week 1 | Break-glass accounts checked and excluded correctly, with sign-in alerting on them | 3.1.1, 3.1.5, 3.3.1 | Entra ID emergency-access accounts, alert policy | Any | Break-glass procedure, last test date, alert configuration |
| Week 1 | Multifactor authentication for every user through Conditional Access; phishing-resistant methods for admins | 3.5.2, 3.5.3, 3.5.4 | Entra Conditional Access, authentication-methods policy | Entra ID P1 (in Business Premium, E3 and E5) | Conditional Access policy export, authentication-methods policy, MFA registration report |
| Week 1 | Admin roles: separate admin accounts, least privilege, role review | 3.1.4, 3.1.5, 3.1.6, 3.1.7 | Entra roles; Privileged Identity Management where licensed | Any; Privileged Identity Management needs Entra ID P2 or Entra ID Governance | Role-assignment export, admin account list, review record |
| Week 1 | Sign-in protections: lockout, session limits, sign-in banner text | 3.1.8, 3.1.9, 3.1.11 | Entra smart lockout, Conditional Access sign-in frequency, company branding | Entra ID P1 for Conditional Access session controls | Settings exports, Conditional Access policy export |
| Week 2 | Block legacy authentication | 3.5.3, 3.5.4, 3.1.1 | Conditional Access | Entra ID P1 | Conditional Access policy export, sign-in log query |
| Week 2 | Email protection: anti-malware, anti-phishing, Safe Links and Safe Attachments | 3.14.2, 3.14.4, 3.14.5, 3.14.6 | Built-in protection for cloud mailboxes; Defender for Office 365 Plan 1 | Built-in protection in every tenant with cloud mailboxes; Defender for Office 365 Plan 1 in Business Premium and, since July 1, 2026, in Office 365 E3 and Microsoft 365 E3; Plan 2 in E5 | Policy exports, quarantine report |
| Week 2 | External sharing and guest access for SharePoint, OneDrive and Teams | 3.1.3, 3.1.20, 3.1.22 | SharePoint and Teams sharing settings, Entra external collaboration | Any | Sharing-settings export, guest inventory |
| Week 2 | App consent: user consent off, admin-consent workflow on | 3.1.1, 3.1.2, 3.4.9 | Entra enterprise-app consent settings | Any | Consent settings, approved-app list |
| Week 3 | Device enrolment and compliance; require a compliant device for CUI apps | 3.1.1, 3.1.18, 3.5.1, 3.4.1 | Intune enrolment and compliance policies, Conditional Access "require compliant device" | Microsoft Intune Plan 1 (in Microsoft 365 E3 and E5) + Entra ID P1; the pre-flight checklist confirms your plan has it | Device inventory export, compliance policy export |
| Week 3 | Configuration: security baseline, screen lock, logon banner, removable media, local admin removal, user-installed software | 3.4.2, 3.4.6, 3.4.7, 3.4.9, 3.1.10, 3.1.9, 3.8.7, 3.1.5 | Intune configuration profiles and security baselines | Microsoft Intune Plan 1 | Profile exports, assignment report |
| Week 3 | Encryption at rest on laptops and mobiles | 3.13.16, 3.1.19 | BitLocker and FileVault through Intune, mobile compliance | Microsoft Intune Plan 1 | Encryption report, proof of recovery-key escrow |
| Week 3 | Endpoint protection, detection and response, vulnerability view, update rings | 3.14.1, 3.14.2, 3.14.4, 3.14.5, 3.14.6, 3.14.7, 3.11.2, 3.11.3 | Defender for Business (or Defender for Endpoint), Windows Update rings | Defender for Business in Business Premium; Defender for Endpoint Plan 2 in E5 | Onboarding report, vulnerability export, update-ring report |
| Week 4 | Sensitivity labels for CUI, applied manually, with label-based encryption | 3.8.4, 3.1.3, 3.13.16 | Microsoft Purview Information Protection | Manual labels in Business Premium, E3 and E5; automatic labelling needs E5-class licensing | Label policy export, label usage report |
| Week 4 | Data loss prevention for email and files | 3.1.3, 3.1.22 | Purview DLP for Exchange, SharePoint, OneDrive and Teams | Business Premium, E3 and E5; endpoint DLP needs E5-class licensing or a Purview add-on | DLP policy export, sample incident report |
| Week 4 | Audit logging on, audit roles limited, retention plan | 3.3.1, 3.3.2, 3.3.8, 3.3.9 | Purview Audit (Standard), Audit Reader and Audit Manager role groups | Audit (Standard) keeps 180 days; longer needs Audit (Premium)/E5, an add-on, or your own export | Audit status, role-group membership, retention or export procedure |
| Week 4 | Alerting and a review cadence | 3.3.5, 3.14.6, 3.14.7 | Default alert policies, Defender incidents | Any (advanced alerts vary by licence) | Alert policy list, review log template |
| Week 4 | Evidence checklist, manual-requirements list and readout | 3.4.3, 3.12.1, 3.12.3 | Change log and checklist workbook | n/a | Change log, evidence checklist, readout |
REQUIREMENT IDS: NIST SP 800-171 REV. 2, THE REVISION CMMC LEVEL 2 AND DFARS 252.204-7012 USE · LICENCES AS OF NOV 4, 2026
What this engagement doesn't touch
No tenant setting covers these. The readout lists them by name and hands them to the Readiness Assessment.
- Awareness and training (3.2)
- Incident response (3.6)
- Maintenance (3.7), apart from multifactor authentication for remote maintenance
- Most media protection (3.8.1–3.8.3, 3.8.5, 3.8.8)
- Personnel security (3.9)
- Physical protection (3.10)
- Risk assessment (3.11.1)
- The POA&M (3.12.2) and the SSP (3.12.4) as documents
- The policy and procedure objectives of every requirement
Free tools you run, never resold
- Microsoft Secure Score. Built into your tenant. You record it before and after, as a by-product, never as a compliance score.
- CISA ScubaGear. CISA's free assessment tool for its SCuBA Microsoft 365 baselines, released into the public domain. You run it in your tenant and keep the report.
What you pay for is what Microsoft doesn't give away: the order of work, a defensible CUI boundary, the requirements no tool checks, and evidence an assessor can follow.
Licence notes · as of Nov 4, 2026
Most of it is already in your plan.
- Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5.
- Microsoft 365 Business Premium is for organizations with up to 300 users, and includes Defender for Business.
- Defender for Office 365 Plan 1 is included in Business Premium and, since July 1, 2026, in Office 365 E3 and Microsoft 365 E3.
- Automatic sensitivity labelling and endpoint data loss prevention need E5-class licensing or a Purview add-on. Manual labels and DLP for email and files are in Business Premium and E3, and they are what this engagement uses.
- Audit (Standard) keeps 180 days of records. Keeping them longer needs Audit (Premium) or an add-on, or an export your admin runs on a schedule.
- Microsoft lists Office 365 commercial and GCC among the services that use FIPS 140-2 validated cryptographic modules. Whether your configuration and endpoints meet requirement 3.13.11 is still a question for your settings and your assessment.
Microsoft changes plan contents. The pre-flight checklist confirms what your tenant actually has before session 1, and every step has an alternative for when a feature isn't there.
See it for your licence. The free Tenant Fit Check maps every step below to your plan and flags whether this tenant suits your CUI. Run the Tenant Fit Check →
Want the four weeks on your wall? The free Hardening Blueprint lets you explore every step, and gives you an A2 poster and an Excel evidence tracker. Explore the Hardening Blueprint →
Commercial or GCC
GCC tenants use the same playbook and the same admin portals. Where a feature is missing or arrives later in GCC, that step's "if the feature isn't there" path covers it. GCC High isn't covered yet: on GCC High, or on Google Workspace, AWS or Google Cloud, start with the Readiness Assessment.
Is this the right home for your CUI?
Microsoft says the Office 365 GCC High and DoD environments support customers who need DFARS 7012, NIST 800-171 and ITAR compliance. If your CUI includes ITAR or export-controlled data, or your contracts point to GCC High, week 1 says so plainly and explains the trade-offs. You decide whether to keep hardening the current tenant. A migration is out of scope.
The no-access promise
We guide. Your admin clicks. We never log in.
- No accounts of any kind in your tenant: no GDAP, guest accounts or reader roles.
- You host every session in your own Teams, and nobody records it.
- You share one admin portal window at a time. Never mail, files or SharePoint.
- The fix list and every tool report stay in your tenant. We keep only a summary with no tenant identifiers.
- Break-glass accounts are checked first. Every change has a change window, a rollback step and your approval, and goes in the change log.
- Your own admin, or your MSP on your instructions, makes every change.
Every step, written five ways
So no session depends on finding things out live, each playbook step has: a pre-check of the licence, role and feature it needs; the dated portal path; a PowerShell or Microsoft Graph fallback for when a page moves; an alternative if the feature isn't in your plan or cloud; and the rollback and evidence export.
If your MSP makes the changes, it attends as your hands, under your SOW and your change approval.
The next step
Next: the Level 2 Readiness Assessment
The Assessment picks up from your snapshot, fix list, change log and evidence checklist, so it starts at the boundary rather than at discovery. Book it within 60 days of the readout and part of the hardening fee is credited toward it.