Phase 03 · 2026-10-14 · 6 min
80–90% of CMMC is documentation. Here's how to do it right.
The technical controls are often already in your Microsoft tenant. The real work is proving your policies match what you actually do.
When people picture CMMC Level 2, they picture firewalls and encryption. In practice, most of the effort is documentation: policies, configuration records, and the continual review process that proves you're doing what you say.
The last 10% is good cyber hygiene
Multi-factor authentication, logging, encryption at rest — much of this is already built into platforms like Microsoft 365 GCC High. The hard part is tying each configuration back to a written control and showing evidence.
Where teams get burned
- Consultants write beautiful policies nobody follows.
- Review cycles exist on paper but not on calendars.
- Evidence is collected once and goes stale before the assessor arrives.
What to do instead
Write policies with the people who run the systems. Attach evidence to every control with a review date. And build review into your weekly rhythm so compliance is a habit, not a sprint.
— Nathanael Dick, CISSP, CCP