Eli Selig, an owner of San Diego Computer Consulting, serves as our CMMC 2.0 Master Prep Engineer, specializing in the design, implementation, and preparation of secured networks and workstations. Eli oversees the technical security measures necessary to help organizations prepare for CMMC 2.0 requirements, including secure workstation configurations, network security, access controls, authentication, endpoint protection, data protection, and other cybersecurity safeguards. His experience and hands-on involvement provide our clients with knowledgeable technical leadership throughout the CMMC preparation and implementation process.
Eli Selig – CMMC 2.0 Readiness Engineer
**Important Update** CMMC 2.0 Security & Compliance
As of October 14, 2026,
The Department of War has announced a suspension of the planned CMMC Phase II requirements. Level 1 and Level 2 self-assessment requirements remain in place while the program undergoes review. Existing contractual cybersecurity obligations still matter, so contractors should check their specific contract language rather than assume the requirements have disappeared.
CMMC 1.0 Security & Compliance
CMMC 1.0 Foundational
Purpose: Protect Federal Contract Information (FCI).
- 17 basic security practices based on FAR 52.204-21.
- Examples include controlling access to computers, limiting who can view contract information, and protecting systems and communications.
- Generally requires an annual self-assessment and annual affirmation.
- No independent C3PAO certification assessment is required for Level 1.
Typical fit: Contractors handling basic government contract information but not CUI
CMMC 2.0 Security & Compliance
CMMC 2.0 is designed to protect Controlled Unclassified Information (CUI) and ensure that the systems handling that information have appropriate cybersecurity controls in place. For organizations working with Department of Defense contracts, achieving CMMC compliance requires more than simply installing security software—it requires documented policies, properly secured computers, continuous monitoring, and controls over how sensitive information is accessed and transferred.
Purpose: Protect Controlled Unclassified Information (CUI).
- Implements the 110 security requirements in NIST SP 800-171 Revision 2.
- Includes multifactor authentication, access controls, audit logging, vulnerability management, incident response, encryption where required, and system security documentation.
- Requires a System Security Plan (SSP) and management of identified security deficiencies through a Plan of Action and Milestones (POA&M), where permitted.
Depending on the contract and assessment schedule, requires either a self-assessment or an independent assessment by a Certified Third-Party Assessment Organization
Data Loss Prevention (DLP)
Sophos DLP controls can be used to help control how sensitive information is copied, transferred, or removed from protected computers.
DLP policies can help restrict or monitor activities such as:
- Copying sensitive information to USB drives
- Transferring protected information to unauthorized locations
- Copying or moving sensitive files
- Unauthorized use of removable media
- Other methods of removing CUI from the protected environment
These controls provide an additional layer of protection against accidental or unauthorized disclosure of CUI.
Building a Secure CMMC Environment
CMMC compliance is ultimately about creating a documented, controlled, and continuously monitored IT environment. The combination of security documentation, endpoint MDR, centralized Active Directory management, CUI controls, and DLP provides a strong foundation for protecting sensitive information and supporting CMMC requirements.
SDCC can assist with the implementation, management, documentation, and ongoing maintenance of the IT security environment required to support your CMMC 2.0 objectives.
Secure Computer Management Through Active Directory or Entra
Computers within the CMMC environment should be centrally managed and properly secured. Active Directory provides centralized control over user accounts, permissions, security policies, authentication, and computer configurations.
Security policies can be applied consistently across the organization, helping ensure that computers are configured and maintained according to the organization’s CMMC security requirements.
Microsoft Office 365 GCC High For CMMC 1.0
Microsoft 365 Government Community Cloud (GCC) is a specialized version of Microsoft 365 designed to help eligible U.S. government organizations and businesses serving government agencies meet specific security, compliance, and data-handling requirements.
Unlike standard commercial Microsoft 365 subscriptions, GCC requires special government cloud licensing and eligibility verification. It operates within Microsoft’s dedicated U.S. government cloud environment, designed to support applicable government security and compliance requirements.
GCC provides familiar Microsoft productivity tools, including Exchange Online, SharePoint, OneDrive, Teams, Word, Excel, and PowerPoint, with government-specific security and compliance capabilities.
Microsoft Office 365 GCC High For CMMC 2.0
Advanced Government Cloud Solutions for Organizations Handling Sensitive Government Data: CUI
Microsoft 365 Government Community Cloud High (GCC High) is a specialized Microsoft cloud environment designed for eligible U.S. government agencies, defense contractors, and qualifying organizations that must meet stringent government security and compliance requirements.
Unlike standard commercial Microsoft 365, GCC High requires specialized licensing, eligibility verification, and provisioning through an authorized licensing channel. It operates in a dedicated U.S. government cloud environment designed to support sensitive government workloads and applicable federal compliance obligations.
Two-Factor Authentication on Every Computer & Device
San Diego Computer Consulting implements Multi-Factor Authentication (MFA) as an important security control for protecting access to systems and Controlled Unclassified Information (CUI). User accounts are required to use two-factor authentication, combining a password with a second method of verification, such as Microsoft Authenticator, a security key, or another approved authentication application. MFA provides an additional layer of protection by helping prevent unauthorized access even if a user’s password is compromised. MFA is enforced for remote access, cloud applications, VPN connections, and administrative accounts, with access policies centrally managed through Microsoft Entra ID, Active Directory, and other approved security controls. These measures help ensure that only authorized users can access company systems and CUI and are an important component of the organization’s overall CMMC 2.0 security program.
