Should a CMMC workload run on Azure or Azure Government?
Microsoft states that both Azure and Azure Government hold FedRAMP High provisional authorizations, and that most defense contractors are best aligned with Azure Government. That alignment rests on Microsoft's contractual commitments to store customer data in the United States and to limit access to screened US persons. Whether those commitments fit your workload depends on three things: where your CUI must stay, which of your contracts or customers impose data residency or personnel conditions, and how much of the 110 Level 2 requirements under 32 CFR 170.14(c)(3) you would still own after moving to the cloud. Read the commitments against your contract language, not only the marketing summary.
Keep the scope question clear. CMMC applies to your organization and the systems you use to handle CUI, not to the cloud platform itself, so there is no CMMC certification for Azure or Azure Government. Microsoft says a contractor providing a cloud-based solution must ensure the underlying platform holds at least FedRAMP Moderate authorization. Your own on-premises infrastructure that connects to the cloud stays in your assessment scope either way. Ask Microsoft for its CMMC Product Placemat and Technical Reference Guide, then mark which practices are inherited, shared or yours before you choose a tenant.
Your organization owns its controls. An implementation partner can configure Azure resources, prepare the system security plan, document the customer responsibility matrix and assemble evidence, but a C3PAO or other authorized assessor is the only party that issues a Level 2 result, and the assessor must confirm that the cloud provider's responsibilities are current and complete. Confirm with Microsoft which FIPS 140 validated Azure Key Vault HSM options apply to your customer-managed keys, and confirm the current CMMC assessment status with the Department of War before you commit budget, since its CMMC Phase II requirements were suspended in July 2026.
When Azure Government fits and when commercial Azure may
If your defense contract data is CUI and nothing else sensitive, the decision depends on whether the cloud platform meets the authorization level your assessor expects and whether your contracts add residency terms. Microsoft says most defense contractors align best with Azure Government because it commits to storing customer data in the United States and limits access to screened US persons. Commercial Azure can also host a CMMC solution, and Microsoft says an accredited 3PAO has attested that both meet the applicable DFARS 252.204-7012 requirements, so CUI alone does not by itself require the government cloud. Microsoft's Azure compliance documentation for CMMC is the natural starting point for the platform side.
- Authorization: Microsoft says both Azure and Azure Government hold a FedRAMP High provisional authorization. Microsoft also says a cloud-based solution must rely on a platform with at least FedRAMP Moderate authorization.
- Responsibility matrix: Whichever cloud you choose, the customer responsibility matrix must be current, name every party with security responsibilities, and cover each in-scope requirement the provider handles wholly, partly or jointly.
- Scope stays put: Your on-premises systems that connect to Azure remain in the assessment scope regardless of the cloud you pick.
- Inheritance mapping: Microsoft's Product Placemat and Technical Reference Guide for CMMC show which practices you inherit, which are shared and which you own.
Check with your contracting officer or prime whether the contract or flowdown names a region or personnel requirement before you default to either cloud.
Export-controlled technical data adds access rules on top of CUI handling. The central question shifts from where the data sits to who can see it. Microsoft says Azure Government contractually limits access to screened US persons, which is the commitment that most ITAR-driven programs look for when they evaluate a cloud platform. Commercial Azure data can be assessed for CMMC, but any US-person restriction on that platform must come from your own identity design, administrative controls and contract terms, and the assessor will test those controls rather than accept a general statement.
- Provider access: Microsoft's Azure Government commitment covers provider personnel who can access customer data. Confirm the exact scope of that commitment in Microsoft's documentation and your agreement before you rely on it.
- Your access controls: On commercial Azure, you must restrict tenant administrators, support paths, guest users and data sharing to US persons through your own role assignments and procedures.
- Classification: Whether a given technical dataset is ITAR or EAR controlled is a legal determination your export compliance team makes. A CMMC assessment does not settle that question.
- Evidence: Keep records of who holds administrative roles, how US-person status was verified and how those roles are reviewed, because the assessor will ask for them.
Ask your export compliance lead to confirm the classification of each dataset before you choose a cloud region, tenant or support model.
Some primes and customers write a US-only storage clause into a contract or subcontract, and that clause can be stricter than CMMC itself. Microsoft's stated commitment to store customer data in the United States makes Azure Government the simplest way to meet such a clause without designing the residency controls yourself. Commercial Azure can still satisfy a US-only storage requirement if you configure regions and document the configuration, but the clause must be read against the platform's terms, and the choice changes how you explain scope to your assessor and to the customer who wrote the clause.
- Clause scope: Read the clause closely to see what it covers, such as primary data, backups, logs, support access and metadata. These categories may be treated differently in provider terms.
- Region enforcement: On commercial Azure, you would restrict deployment regions yourself, for example through Azure Policy, and show the assessor the policy assignments and their results.
- Subcontractor flowdown: If you pass CUI to a subcontractor, that party's storage and access terms must also satisfy the clause, and the subcontractor's systems must be reflected in your scope.
- Residency evidence: Keep provider documentation and exports of your own configuration that show where each data category resides.
Have your contracts team interpret the clause in writing before you commit to a region design.
Many contractors run commercial Microsoft 365 and Azure for non-defense work alongside a CUI environment. Separating the defense side into its own tenant or subscription narrows what the assessor must review, but scope follows the systems that store, process or transmit CUI, not the account names. Azure Government is the common choice for the defense side, while commercial workloads can stay where they are if the boundary is clean. The decision turns on how clearly you can draw and document that boundary, which is a question for your architecture and assessor, not for the price list.
- Boundary definition: Identify which subscriptions, identities, networks, endpoints and users touch CUI, and record that boundary in your system security plan.
- Identity crossovers: Shared identity providers, administrator accounts, collaboration tools and monitoring platforms are where commercial and defense scopes most often blur.
- Effort by scope: Running two environments adds administration, monitoring and assessment work. Ask any consultant to quote each environment separately, because effort follows the size of the in-scope footprint.
- Single-tenant exposure: Placing all workloads in one tenant can bring every system and user into the assessment, which increases what the assessor reviews.
Map every system that handles CUI before you assign workloads to a cloud, and confirm the resulting boundary with your assessor early.
Which Level 2 practices Microsoft inherits and which you still own
The first step is to sort every Level 2 practice into one of three buckets: practices Microsoft inherits from the cloud service, practices shared between Microsoft and your team, and practices you own outright. Microsoft's Product Placemat and Technical Reference Guide for CMMC is the starting document for that sort. It shows, for each practice, which party carries the responsibility, so your team can build its system security plan from the vendor's split rather than from memory. Read it against the Azure and Azure Government services you actually deploy, because the inheritance depends on the service, not on the subscription. Confirm the guide's current version with Microsoft before you rely on it, since the document is updated alongside the platform.
Azure Policy gives you a way to check that the configuration you documented is the configuration you run. Microsoft ships built-in regulatory compliance initiatives for NIST SP 800-171 in Azure Policy for both Azure and Azure Government. Assign the initiative at the management group or subscription scope, review the compliance dashboard, and export the results as evidence of continuous monitoring. Treat the initiative as a detection tool, not a proof of compliance: a passing policy state does not show that your people followed procedures, reviewed logs or handled exceptions. Confirm which initiative version your tenant offers and which controls it maps to in your environment, since built-in definitions change.
Assessors do not accept the inheritance split on Microsoft's word alone. Under CAP v2.0, they check that the customer responsibility matrix is current, names every party with security responsibilities, and covers every in-scope requirement that the provider performs wholly, partly or jointly. Gaps in the matrix are common when a contractor has added services or changed a configuration since the last review. Your on-premises infrastructure that connects to the cloud remains in your assessment scope regardless of the provider, including identity synchronization servers, network connections, endpoints and administrator workstations. Document that boundary in the SSP, and ask your assessor early which connection points they will test.
How FIPS 140 key management in Azure Key Vault supports the SC family
The SC family asks how cryptographic keys are generated, stored, used and controlled, so key management is where a cloud platform's controls meet the contractor's own obligations. The four cards below separate what the platform provides from the decisions and checks that remain with the contractor and its assessor.
Customer-managed encryption keys
Microsoft states that Azure and Azure Government support customer-managed encryption keys, so the contractor can hold key control rather than accepting platform-default keys. In an assessment, the question is who can create, disable and delete the keys that protect CUI at rest. Document the key hierarchy, the Key Vault instances that hold it, and the roles that can manage them, and confirm the same design applies to both clouds if you use both.
FIPS 140 validated HSMs in Key Vault
Microsoft says Azure and Azure Government support customer-managed keys stored in FIPS 140 validated hardware security modules managed by Azure Key Vault. Assessors look for this validation when they check cryptographic protection for CUI, so the platform claim must be traced to a specific validated module. Record the Key Vault tier and key type used for each workload in the SSP, since the HSM-backed option is the one tied to the validation claim.
Rotation and ownership decisions
Key rotation schedules, key owners and the procedure for emergency revocation are decisions the contractor makes and must document. A platform can rotate keys on a schedule, but the contractor still has to define the period, approve the change and show evidence that rotation happened. Write these decisions into the system security plan with named owners, and keep rotation records as evidence for the SC requirements on key management.
Confirming validation certificates per use
A FIPS 140 validation applies to a specific cryptographic module in a specific configuration, not to a cloud service as a whole. For each cryptographic use, such as data at rest, backups, TLS to users and key wrapping for on-premises connections, ask the vendor for the validation certificate and module name, then confirm with your assessor that it covers how you use it. Keep these certificate references in the evidence package, since a general statement about FIPS support does not substitute for them.
Where the cost of a CMMC cloud environment sits
This sequence separates the cost of the cloud platform, the implementation work, internal effort and any assessor fee, so you can see which items are paid once and which recur. No price is stated here; request a fixed-scope quote with written deliverables before you commit.
Identify which fees go to Microsoft
Start by listing what Microsoft charges for the Azure or Azure Government subscriptions that will hold the CUI workload. Consumption fees for compute, storage, logging, Key Vault and networking are usually metered and recur monthly, so they rise with data volume, retention periods and the number of always-on resources. Ask your Microsoft account team or reseller to confirm which services and regions your design needs, and whether Azure Government pricing differs for your contract. The output is a service-by-service list of recurring charges that your finance team can review.
Scope a fixed implementation for the landing zone
Next, an implementation partner scopes the one-time build: a landing zone, identity and multifactor authentication, centralized logging, customer-managed keys in Key Vault backed by FIPS 140 validated hardware security modules, and network boundary controls. Cost here depends on the number of subscriptions, the number of integrated systems and how much existing configuration you must migrate. Request a written statement of work that lists each deliverable, the configuration records you will receive and the acceptance check for each item. The output is a signed scope that separates the one-time build from any ongoing support retainer.
Map which practices Microsoft and you own
Before the build is priced in detail, map each in-scope NIST SP 800-171 Rev. 2 requirement to the Microsoft Product Placemat and Technical Reference Guide for CMMC, so you know which practices you inherit, which are shared and which remain yours. Internal staff time is the largest recurring cost here, because policies, access reviews, training records and incident procedures stay with your organization. Ask the partner to show how the customer responsibility matrix will be maintained and who signs off on it. The output is a responsibility matrix that is current and names every party with security responsibilities.
Account for internal staff time on policy and evidence
Your internal team writes and approves the system security plan, maintains the asset inventory, runs access reviews, tracks plans of action and milestones, and collects evidence in final form. Effort rises with the number of users, systems and subcontractors that touch CUI, and it recurs because evidence must stay current between assessments. Estimate this time with your security and contracts leads, and treat it as an operating budget line rather than a project line. The output is a documented staffing plan that names owners for each recurring evidence task.
Price the on-premises connection and related scope
Your own on-premises infrastructure that connects to the cloud remains in the assessment scope, so endpoints, network links, identity connectors and administrative workstations may need hardening and documentation of their own. These costs are often one-time for hardware and configuration and recurring for patching, monitoring and review. Ask the partner to identify each on-premises component that touches the enclave, the fixed work to secure it and the evidence it will produce. The output is a scoped list of on-premises items with their one-time and recurring effort noted.
Confirm whether a certification assessor fee applies
The fee paid to a C3PAO applies only when a Level 2 certification assessment is required for your contract. The Department of War suspended CMMC Phase II on 13 July 2026, so confirm with your contracting officer and the current DoW CIO guidance whether a certification assessment applies to your contracts before you budget for it. Self-assessment and SPRS posting costs remain your own internal effort. The output is a written determination from your contracts team about which assessment type applies to each contract.
Request a fixed-scope quote with written deliverables
With the scope, staffing plan and assessment determination in hand, request a fixed-scope quote from each implementation partner. Ask that it list one-time build items separately from recurring support, name each deliverable and acceptance check, state what is excluded, and identify who pays Microsoft directly. Compare quotes on the same scope rather than on headline totals. The output is a written quote and statement of work that you can attach to your system security plan and procurement file.
Questions buyers ask about CMMC on Azure
Can we run CMMC on commercial Azure?
Yes, a CMMC workload can run on either Azure or Azure Government, according to Microsoft. Microsoft says CMMC certification can be obtained for solutions on either platform, but it also says most defense contractors are best aligned with Azure Government because of its contractual commitments to store customer data in the United States and limit access to screened US persons. Commercial Azure is therefore a valid option, but the data residency and personnel access terms should be compared against your contract requirements and your own risk appetite. Ask your provider and your contracting officer to confirm which environment satisfies your specific contract language before you commit.
Does Microsoft's FedRAMP High status make us compliant?
No. Microsoft's FedRAMP High provisional authorization for Azure and Azure Government is a fact about the cloud platform, not a CMMC result for your organization. Microsoft says CMMC does not apply directly to cloud services, so there is no CMMC certification for a platform such as Azure. If your workload is a cloud-based solution you provide, the underlying platform must hold at least FedRAMP Moderate authorization, but you still have to implement and evidence the Level 2 practices for your own system, your own people and your own on-premises connections. Microsoft also says an accredited 3PAO has attested that Azure and Azure Government meet the applicable DFARS 252.204-7012 requirements, which supports your incident and cloud obligations but does not replace your assessment.
Who issues the CMMC result for a cloud?
Level 2 certification assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. Neither Microsoft nor an implementation partner issues a CMMC result. The result applies to the organization seeking the assessment, and the assessor reviews the systems in your scope, including the cloud services you use and the infrastructure you run yourself. Level 2 self-assessments are performed by the organization itself. Your cloud provider may supply documentation, such as its Product Placemat and Technical Reference Guide, but that documentation is evidence for your assessor to review, not a certificate.
What does a provider's customer responsibility matrix need to contain?
A customer responsibility matrix should show, for each in-scope requirement, which practices the provider performs, which are shared and which remain with you. The Cyber AB's CAP v2.0 requires assessors to check that an External Service Provider's matrix is current, names all parties with security responsibilities and covers every in-scope requirement the provider performs wholly, partly or jointly. Your System Security Plan must document or reference that matrix (32 CFR 170.16(c) and 170.17(c)). Confirm with your provider that its matrix is dated, that it covers the specific services you purchase and that it lists the tenant-level settings you must configure yourself, such as identity policies, logging and key management.
Do we need an implementation partner, or can we do it ourselves?
You can do it yourselves if your team has the skills and capacity, because the organization owns its controls and its evidence. An implementation partner can help prepare the environment, configure controls, document the SSP and organize evidence in final form, but it cannot issue an assessment result. The cost depends on how many systems and users are in scope, how much on-premises infrastructure connects to Azure, how complete your current documentation is and whether you need Level 2 certification or only a self-assessment. Ask any partner for a written scope, deliverables and timeline, and confirm which tasks remain with your staff. DeployOpen plans and implements self-hosted open-source platforms in your own infrastructure and prepares evidence for assessment, but it does not perform or certify assessments.
Does the 2026 suspension of Phase II change the Azure decision?
The suspension changes the timing of certification requirements, but it does not remove your current obligations. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The Azure decision still depends on your contract terms, data residency needs and the controls you must evidence, so the environment you choose should meet your current obligations regardless of when certification is required. Confirm the current CMMC status and any transition expectations with your contracting officer before you finalize scope.
Which Azure controls stay in our scope?
Your on-premises infrastructure that connects to Azure stays in the assessment scope regardless of which cloud you choose. In practice this includes the endpoints, identity sources, network connections and administrative workstations that reach your Azure tenant. Microsoft's Product Placemat and Technical Reference Guide for CMMC shows which practices you inherit, which are shared and which you own, and Azure Policy includes NIST SP 800-171 regulatory compliance initiatives for Azure and Azure Government. Use those as starting points, then verify each configured setting against the requirement it supports. Confirm with Microsoft which customer-managed encryption keys in Azure Key Vault you must use to meet FIPS-validated cryptography expectations.
What to check before choosing an implementation partner or assessor
A partner can prepare your Azure Government environment, evidence and documentation, but it cannot tell you whether you meet CMMC. The checks below separate the work a partner does from the judgment only an independent assessor can make, and they show what to get in writing before any work begins.
Written scope and deliverables first
Ask for a written scope that names the Azure Government subscriptions, the on-premises systems that connect to them, the NIST SP 800-171 requirements the partner will address, and each deliverable with its acceptance criteria. Confirm which items are covered by a fixed fee and which would be billed as change requests. A scope that only says "CMMC readiness" leaves the boundary of your assessment undefined, and that boundary decides what the assessor will examine.
Preparation without a certification result
Confirm in writing that the partner prepares systems, the System Security Plan and evidence, but does not score your requirements or issue any CMMC result. Only an authorized or accredited certification body can issue a Level 2 certification, and a partner that promises a pass or a status has crossed that line. Ask who signs your affirmations and who owns each control after handover.
Assessor accreditation and independence
For a Level 2 certification assessment, confirm the assessor is a C3PAO authorized or accredited through The Cyber AB, and check its status on the Cyber AB registry before signing. Ask the partner to confirm in writing that it has no role in the assessor's team or findings, and that the same people did not both build and assess the same controls. Independence protects the credibility of your result.
Azure Government experience specifically
Azure and Azure Government differ in access controls, data residency and the screened US persons commitments that Microsoft describes for most defense contractors, so general Azure experience is not enough. Ask for examples of Azure Government tenants, Key Vault configurations with customer-managed keys in FIPS 140 validated hardware security modules, and Azure Policy initiatives mapped to NIST SP 800-171. Ask who on the team holds the Azure Government credentials used in the work.
Handover of SSP, matrix and policy evidence
Ask how the partner will hand over the System Security Plan, the customer responsibility matrix and the Azure Policy compliance exports, and in what form. The matrix should name every party with security responsibilities and cover each requirement the cloud provider performs wholly, partly or jointly, and it should be kept current. Ask for the plan for keeping these documents updated after the engagement ends, and who holds the source files.
How DeployOpen prepares an Azure CMMC environment
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own Azure or Azure Government subscriptions. We prepare the systems, controls and evidence that an assessor will review, while your organization owns its controls and an independent C3PAO or other authorized assessor issues any certification.
How we scope
- We agree a written scope that names the Azure or Azure Government subscriptions, workloads and connected on-premises systems in the assessment boundary.
- We map which NIST SP 800-171 Rev. 2 requirements Microsoft inherits, shares or leaves with you, using Microsoft's CMMC documentation as the starting point.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work starts, and a quote follows from that scope.
How we build
- We configure identity, logging, network boundaries and encryption in your tenant, with customer-managed keys in Azure Key Vault where your scope requires them.
- We set up Azure Policy regulatory compliance initiatives for NIST SP 800-171 and review the non-compliant resources they report against your documented scope.
- We integrate self-hosted open-source tools for the Level 2 control areas you select, and confirm their FIPS-validated cryptography behavior with the vendor before relying on it.
How we hand over
- We deliver the System Security Plan, the customer responsibility matrix and the evidence set, written so your assessor can trace each requirement to a configuration.
- We document the boundary, shared responsibilities with Microsoft and any service provider, and the owner for each control after handover.
- We provide runbooks and configuration records so your staff can operate and reproduce the environment without ongoing reliance on DeployOpen.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after the initial engagement closes.
- Retainers can cover evidence refresh, configuration drift review and updates to the SSP when your boundary or Azure services change.
- Security testing of applications, APIs and cloud configuration can be scheduled to support your risk assessment and vulnerability remediation cycle.
