CUI Decontrol and Sanitization: Records Retention for the DIB
CUI status does not change how long you keep records; decontrol and sanitization handle markings and media while contracts and schedules drive retention.
Tag: CMMC
· CMMCMulti-Factor Authentication Methods Acceptable Under CMMC
CMMC Level 2 expects MFA for specific access types; this post explains acceptable factor types, Microsoft methods that fit, and the evidence assessors request.
Sensitivity Label Inheritance: When Files Keep Their CUI Markings
Sensitivity label inheritance in Microsoft Purview can help files and emails keep CUI-equivalent markings, but contractors need clear NARA-aligned marking policy, targeted configuration, and testing to make the behavior hold across Office, Exchange, SharePoint, and OneDrive.
Boundary Diagrams That Satisfy a NIST 800-171 Assessment
Assessors accept boundary diagrams that show the true system boundary, key internal boundaries, and CUI flows, supported by evidence that matches the SSP and CMMC scoping.
· CMMCDocumenting Inherited Controls in a CUI Environment
Inherited controls help only when you define the CUI boundary, assign ownership for each assessment objective, and point to evidence in the SSP and CRM that applies to in-scope assets.
Microsoft Entra Verified ID for DIB Workforce Credentialing
Microsoft Entra Verified ID gives DIB contractors a standards-based way to issue and verify workforce credentials that support identity proofing and access decisions without replacing authentication, multifactor, or compliance obligations.