Who can access systems that handle CUI?
Review the users, devices and processes allowed to connect, then check whether those permissions match the approved list.
3.1.1: authorized access in Microsoft 365 and AVD →Free guides for Microsoft 365 and Azure Virtual Desktop
CMMC Level 2 guides for Microsoft 365, Windows and AVD
Find out what to do, how to check it and which records to keep. Choose a full domain guide below, or a detailed walkthrough for access permissions, CUI transfers or MFA. Follow the sections for the cloud and hosts you use.
These guides cover all 110 requirements and all 320 assessment objectives across the 14 domains. That count describes what you can read here; it does not measure your compliance. Each guide lists its source review date. The instructions have not been tested in a Microsoft tenant.
Use the main Excel gap review workbook to record your review and follow-up actions. The domain templates below help with specific jobs, such as recording training or planning an incident exercise. A completed template does not prove that a requirement is met.
Browse the 14 domains
Choose the subject you need help with. Each guide explains the requirements and checks, with free Word and Excel materials for the work.
What are you trying to check?
Start with a detailed walkthrough for one task, or use the full domain guides below to review all the requirements.
How do we control where CUI goes?
Follow an approved transfer and review sharing, downloads and other routes for moving information.
3.1.3: control the flow of CUI →Does MFA cover the access we need to protect?
Check the accounts and sign-in routes, including exceptions. An enrolled authenticator alone does not prove that MFA is required.
3.5.3: check MFA coverage and sign-in records →All requirements in the first domain
3.1 Access Control
Work through all 22 requirements and 70 assessment objectives in one guide. Check who may connect, what they may do, how sessions and remote access are controlled, and how you handle wireless devices, mobile devices, external systems and public content.
For each requirement, find the settings to review, differences between commercial and government services, and notes for AD DS-only, hybrid joined and Entra joined hosts. Each also includes checks using sample data, records to keep and steps to take if something goes wrong.
Open the full Access Control guide →All three requirements and nine objectives
3.2 Awareness and Training
Connect training to the risks, procedures and security duties in your own organization. Use free Excel trackers, editable Word materials and three fictional exercises to plan training, check understanding and follow up on gaps.
Open the full Awareness and Training guide →All nine requirements and 29 objectives
3.3 Audit and Accountability
Choose the logs you need, check retention and collection, trace activity and respond when logging fails. Use two Excel workbooks, three Word materials and fictional exercises with the Microsoft setup guidance.
Open the full Audit and Accountability guide →Nine requirements and 44 objectives
3.4 Configuration Management
Keep approved baselines and inventories current, review changes before implementation and check software restrictions. Includes Microsoft setup paths, two Excel registers, three Word materials and practical exercises.
Open the full Configuration Management guide →11 requirements and 25 objectives
3.5 Identification and Authentication
Identify users, processes and devices, then check authentication, MFA, identifier rules and password handling. Includes Microsoft setup paths, two Excel trackers, three Word materials and practical exercises.
Open the full Identification and Authentication guide →Full domain guide and free materials
3.6 Incident Response
Prepare roles, reporting, evidence handling and recovery. Work through all three requirements and 14 objectives, with Microsoft setup paths, two Excel trackers, three Word materials and three fictional exercises.
Open the full Incident Response guide →All six requirements and 10 objectives
3.7 Maintenance
Control maintenance tools, personnel, diagnostic media and remote connections. Include off-site sanitization and supervision, with Microsoft setup paths, two Excel registers, three Word materials and three fictional exercises.
Open the full Maintenance guide →All nine requirements and 15 objectives
3.8 Media Protection
Protect paper, drives, transported media and backup copies. Check access, markings, custody, sanitization, removable devices and storage with Microsoft setup paths, two Excel registers, three Word materials and three fictional exercises.
Open the full Media Protection guide →Domains 3.9 through 3.14
Each full guide includes the official objectives, practical implementation checks, five free Word and Excel materials and three fictional exercises. Choose the domain you need next.
2 requirements and 4 objectives
3.9 Personnel Security
Define screening before access and protect CUI systems during and after transfers or departures. Includes restricted record references, access-removal checks and fictional exercises.
Open the full Personnel Security guide →6 requirements and 16 objectives
3.10 Physical Protection
Control facilities, equipment, visitors and physical access devices. Check monitoring, access logs, provider duties and alternate work sites with practical registers and exercises.
Open the full Physical Protection guide →3 requirements and 9 objectives
3.11 Risk Assessment
Assess risk to operations, assets and people. Plan system and application vulnerability checks, review new findings and verify risk-based remediation.
Open the full Risk Assessment guide →4 requirements and 14 objectives
3.12 Security Assessment
Check whether controls actually work, manage corrective actions, monitor effectiveness and keep the system security plan consistent with the real boundary.
Open the full Security Assessment guide →16 requirements and 41 objectives
3.13 System and Communications Protection
Review boundaries, network rules, split tunneling, session protection, cryptography, key management, collaborative devices, mobile code, VoIP and CUI at rest.
Open the full System and Communications Protection guide →7 requirements and 20 objectives
3.14 System and Information Integrity
Identify and correct flaws, maintain malicious-code protection, act on advisories, verify scanning and monitor systems and communications for attacks or unauthorized use.
Open the full System and Information Integrity guide →Detailed walkthroughs
Choose a detailed guide
AC.L1-3.1.1
Decide which users, processes and devices can connect
Write down who and what may use the system. Check Microsoft 365 and AVD permissions against that list, then test whether access works as approved.
Commercial and government clouds
AD DS-only, hybrid joined and Entra joined hosts
AC.L2-3.1.3
Control where CUI can move
Decide where CUI may go, then set Microsoft 365 sharing and AVD controls to match. Test a transfer that should work and each route that should be blocked.
Commercial and government clouds
AD DS-only, hybrid joined and Entra joined hosts
IA.L2-3.5.3
Check MFA for cloud and Windows sign-ins
Check how privileged accounts sign in locally and over the network, then check ordinary users on the network. Test Microsoft 365, the AVD service and Windows sign-in separately.
Commercial and government clouds
AD DS-only, hybrid joined and Entra joined hosts
Match the guide to your environment
Start with the section for your cloud. If you use AVD, also check how the session hosts are joined and read the matching host notes. You can use these guides with your current setup without migrating to another one.
Commercial cloud
Use these sections for Microsoft 365 Commercial and Azure Commercial. Before putting CUI in a service, check that the service, your contract and the handling rules permit it. Configuring the settings does not establish that the service is suitable.
Government cloud
The government instructions cover GCC High and Azure Government. GCC uses different identity and service arrangements, so read its separate notes. Check which features your cloud supports and which your license includes.
Find the instructions for your session hosts
Read the AD DS-only or hybrid joined instructions if your hosts are domain joined. Use the separate Microsoft Entra joined instructions for hosts joined that way. Check how the host is joined, which account the user signs in with and how profile storage authenticates users as three separate questions.
See Microsoft's cloud availability guidance and AVD identity prerequisites.
How to use the guides
- Read the official requirement and objectives. Check what you need before starting and which work your organization or provider must do.
- Follow the setup steps that apply to your deployment. Before buying anything, check the license requirements and supported alternatives.
- Test with harmless files or made-up records. Write down what happened and keep the evidence in your approved environment.
- Use the free worksheet to record each gap, who will address it and the next action. Check that the settings work for each relevant connection or transfer; saving a setting alone does not prove that.
These guides use the same NIST SP 800-171 Revision 2 baseline as the Level 2 worksheet. Microsoft manages parts of the service. Your team or provider still configures it, approves access, runs it and keeps the evidence. The guides do not provide certification or an official assessment.
If you need to identify the information you handle first, use the CUI identification guide and log.
Keep your records in your own environment
You can use the guides without creating a site account or uploading anything. Keep CUI, contracts, credentials, diagrams, security evidence and completed worksheets in your own approved environment. Do not send them by email. For a general question or correction, email cmmc@purposefulsecurity.com.