CMMC Level 2 expects you to protect backup CUI and prove that you can restore systems, so design backup and recovery with FIPS-validated protection, tested restores, and clear scope across primary and backup locations.
FIPS validation attaches to cryptographic modules, so teams must verify the specific Windows and service modules that Microsoft 365 endpoints use and document them against CMMC SC.L2-3.13.11 and SC.L2-3.13.10.
Pick your CMMC target by contract and data type, not preference; FCI points to Level 1, CUI drives Level 2, and only select programs require Level 3 with added 800-172 safeguards and a DCMA DIBCAC government assessment.
Export controls change how you select and configure Microsoft 365, and Microsoft states the customer remains the exporter who must assess cloud use.
You reduce CUI exposure and assessment scope by segmenting the enclave and enforcing a clear, monitored boundary that you can prove to an assessor.
Contractors can protect CUI in email with S/MIME or with Microsoft Purview encryption through sensitivity labels or OME, but the design must meet NIST SP 800-171 cryptographic and flow-control requirements and work for external recipients.