Clarion Street

DoD Named Machine-Readable Evidence as the Fix. The CUI Tier Isn't There Yet.

·15 min read

Federal News Network published a two-part investigation into the CMMC pause on October 26 and 27. Part one carries the cost data from the July request for information, part two the task force’s recommendations. Both are built on a task force summary the department has not released. I expected another round in the argument we have been having since July, about whether the pause was justified. The documents contain something more useful: a cost finding that cuts against the department’s own stated reason for pausing, and two proposed remedies that are about documentation rather than about assessments.

I have made the AI-as-a-data-channel argument already, so this is not a second version of it. What changed in the last nine days is that the Department of War’s own reform package now names the evidence layer as the thing to fix. On the platform side there is one published table of what the compliance layer can do for agents in a government cloud, and every Purview row on it is marked unavailable in GCC. Microsoft publishes no equivalent table for GCC High or DoD, so what happens above GCC is something I have to reason about rather than cite. I will keep those two kinds of statement apart.

What the RFI summary says the cost is

The summary reports 997 responses, 509 of them, or 51 percent, from the defense industrial base. The top cost driver respondents named was not the certification. It was implementation and maintenance of NIST SP 800-171, the control set underneath the program. Within that, the first implementation concern in the department’s email summary is “licensing and recurring annual costs (e.g. Microsoft 365 GCC high),” followed by dedicated enclaves, inconsistent interpretation between subcontractors and their primes and assessors, and external service providers. The average cost to comply with CMMC itself, as distinct from 800-171, was $47,000 among the respondents who cited a figure.

The documentation cluster is the part I keep rereading. Respondents named creation and maintenance of the documentation the NIST controls require, and then, in the same breath, “assembling evidence packages in preparation for assessment and inconsistent and lack of guidance for evidence assessment and reuse across cybersecurity frameworks.” That is the same complaint twice. The work is not only the control. It is the artifact that proves the control, and the guidance for judging those artifacts is what the same sentence says is missing.

Two things to keep straight about provenance. The summary is a document Federal News Network obtained, not something the department published, and DoD declined to comment on 15 specific questions. Part one also leans on anonymous sources, including a claim about the CIO’s intent that I am not going to repeat as fact.

The two recommendations that land on this beat

The task force sorted its options into three buckets: improvements the DoD CIO can make without rulemaking, improvements that are harder and slower and may need rulemaking, and suggestions outside the CIO’s authority. Two items from the first two buckets matter to anyone running AI tools in a CUI environment.

In the no-rulemaking bucket, the task force lists addressing inconsistent CUI marking across the military services, the defense agencies and the defense industrial base. In the one-year bucket, it lists “developing assessment criteria and rule content for machine readable evidence using OSCAL.” That second one is the sentence I would frame, because a task force proposing that assessment rule content be written for a machine is a statement about how evidence should be shaped.

The summary also argues that marking clarity is the largest available cost lever, which reverses the way marking usually gets discussed: “Of all the RFI recommendations, those related to improving clarity in CUI marking has the greatest potential to narrow the DIB population subject to NIST SP 800-171 implementation and cybersecurity related costs.” That turns marking from an obligation contractors fail at into the lever with the most room to shrink the population the department regulates.

Set the two recommendations side by side and I think they touch, though the summary never says so. The OSCAL item is about assessment criteria and rule content. Nothing in the Federal News Network account says a machine-readable assessment consumes a CUI label as an input, and I have no document that says it does. My reasoning is narrower. If a rule is written for a machine to evaluate, the artifact it gets evaluated against has to be identifiable to a machine, and the marking standard the same summary wants clarified is where that identification would start. Treat that chain as my inference rather than as the task force’s finding, which is why the rest of this post stays with what is documented and what is not.

The marking standard is page furniture

The department’s CUI markings training aid from December 2024 is worth reading for what it does not require. For an unclassified document, the mandatory markings are the acronym “CUI” at the top and bottom of each page, plus a designation indicator block on the first page or cover. Portion markings are optional. Contractors are authorized to create and mark their own CUI documents and can be listed as the point of contact in that block.

Every one of those marks is addressed to a person looking at the page. The aid is silent on file metadata. It does not require a label a tool can read, and it does not forbid one either. It simply does not address the question. My reading of that silence is that the machine-readable half is left to each contractor’s own naming and filing practice, and I want to be clear that this is my inference from one document rather than a finding about the regime. A contract clause, an agency requirement or a file plan I have not seen could settle it. Fortra’s write-up states the narrow version of the consequence, and it is the version I am keeping: “If a document is marked as CUI visually but lacks metadata, some tools may not detect it reliably.”

Where that lands in practice depends on the tool, and I do not have a source that settles it. Plenty of DLP and classification products read a page header, or OCR the page, or accept a contractor-defined pattern. Others do not, and I have no survey that says how the market splits. Fortra’s phrasing (some tools, may not, reliably) is an accurate summary of the state of it, and I am not going to upgrade it into a claim that header-marked CUI is unfilterable, because that would be my guess dressed up as a finding. What I will say is that whether a filter catches header-only marking is a property of your tooling rather than of the marking, so it belongs in your test evidence and not in your assumptions. An assessor asking you to demonstrate enforcement will eventually want to see a filter catch a real CUI document.

The tier gap, in Microsoft’s own table

The AI channel is not arriving in that environment, it is already in it. Microsoft 365 Copilot is available today in GCC High and DoD, and has been for a while. Microsoft 365 G7, which bundles G5 with Copilot, the Entra Suite and Agent 365, became purchasable in GCC on October 1 and is not available in GCC High or DoD, where Directions on Microsoft reports customers “will have to wait until closer to the end of 2026.”

The general rule from that analysis is the part I would keep, because it describes a property of the tiers rather than a vendor schedule: “Each regulatory step up from GCC to GCC High to DoD imposes a more restrictive regime that results in a widening feature gap.”

Microsoft’s Agent 365 service description, last updated October 1, has a capability table with 26 rows. It has one availability column, for GCC, and no per-capability column for GCC High or DoD. Twelve of the 26 rows are marked Yes. Every row tagged to the Purview console is marked No, and there are seven of them: audit logs of agent activities and eDiscovery, data lifecycle management, compliance manager coverage of agent interactions, data security posture management, insider risk management, data loss prevention that blocks agents from sharing sensitive content, and “Agents inherit and honor data sensitivity labels.” The Entra row that monitors and blocks noncompliant agent network traffic is also No.

The table separates availability from licensing, and the difference matters for everything below. It carries a column headed “Requires Microsoft 365 E7 / G7 or Agent 365” and another headed “Included with Microsoft 365 Enterprise, Business, Education, and Front Line Worker plans.” Only the first four rows are included with those plans: the agent registry, basic governance actions, condition-based lifecycle rules, and syncing agents in from platforms Agent 365 does not manage. The other eight rows marked Yes for GCC all show No in the included column, so they need the separate Agent 365 subscription, which Microsoft sells “for use with eligible Microsoft 365 subscriptions,” or E7/G7. G7 is not in GCC High or DoD, and Microsoft publishes no per-capability column for either tier.

With that licence in place, the Yes rows tell you what a contractor can do today in GCC: inventory agents in a registry, apply governance actions, set policy templates, restrict which tools agents can reach tenant-wide, use access packages and conditional access for agent identity, and collect unified agent observability logs into Defender for hunting.

The split is consistent. On this table, the GCC Yes rows cover finding your agents, restricting what they touch, and hunting through their activity. The rows an assessor’s question about agent behavior would land on are the No rows: label inheritance, the DLP block on sensitive content, the audit and eDiscovery export with hold, and the data security posture view of agent interactions themselves. In GCC, Agent 365’s documented feature set does not include any of those. That is a statement about one service’s capability table, not a finding that no other Purview path or tenant-specific configuration could produce an equivalent record. I have not found one documented, and I have not surveyed tenants. Microsoft publishes no equivalent table for GCC High or DoD, so the same caution applies up there with even less to go on.

GCC is the least restrictive of the three tiers, the one built for state and local government and smaller organizations, and Directions describes a widening gap as you step up from it. Applying that pattern to these seven rows is a planning assumption on my part, not a documented fact. It would be odd for a compliance capability to be missing from GCC and present in DoD, but odd is not documented, and Microsoft’s page gives me nothing either way. If you are in GCC High, the table is evidence about a tier you are not in. Ask your account team for the same list for your tenant, and treat their not having one as part of the answer.

Microsoft’s fall roadmap post moves capability into the higher tiers in the same window. Memory and personalization, editing with Copilot in Word, Excel and PowerPoint, Copilot Notebooks and Copilot in Forms are planned across GCC, GCC High and DoD. A unified Copilot experience across Teams chats, channels, calls and meetings is planned for GCC High, and intelligent meeting recap for DoD. Meeting transcription is one of the channels Fortra lists, so summarization is heading into the tier where CUI Specified work lives. That post carries no line about the Purview agent compliance capabilities, and I am not going to treat the absence as proof. A roadmap blog is a marketing document, not an inventory, and features ship without an entry. What I can say is that the capability announcements run ahead of any compliance announcement I have been able to find.

What a contractor can do inside the gap

Everything below assumes a GCC tenant. Where an item depends on the add-on licence rather than the base plans, I say so, since that changes what the advice costs.

Label first, even though no requirement I have found asks for the label to be machine-readable yet. The Purview row that matters most is “Agents inherit and honor data sensitivity labels.” The table gives the row’s name and its availability, and nothing else, so how that inheritance would work and what labelling it would need first is something I would be guessing at. What I can say is that labels applied now exist in the tenant if that row ever changes, whatever the mechanism turns out to be, and a labelling project started on the day it does is a project running behind. The label also does work today that has nothing to do with agents, since it is what a human reviewer looks for and what many document-handling tools read.

Constrain what agents can reach while the control plane is available. Tool access control, policy templates, access packages and conditional access are all Yes for GCC, and all four are marked No in the column for what the standard plans include, so they need the add-on. With that in place, the work is not blocked on anything else, and it is the half of agent governance a contractor can finish this quarter.

Keep the evidence you can produce. The agent registry is Yes in GCC on the standard plans, and the observability row and Defender’s unified agent observability logs are Yes once the add-on is in place. An export of the registry with a date on it, a policy template applied and versioned, and hunting logs retained outside the platform will do more for a skeptical assessor than a screenshot of a settings page. The audit row’s own description promises export and hold of agent interactions “for legal, regulatory, and investigative needs,” and it is marked No for GCC, so if the SSP depends on a hold, plan to retain by other means and write down why.

Write the compensating controls into the SSP and name the capability you are waiting on. An assessor who reads “agent DLP is not available in this tenant as of this date, compensating control is a restricted tool list plus a weekly registry export” is looking at a documented gap. The same gap unmentioned is what turns into a finding.

What I am not claiming

The recommendations are advice. The task force report was delivered to the DoW CIO on or about September 11 and still is not public. Only a class deviation, a DFARS rule change or an amendment to 32 CFR Part 170 changes the law, and none of those has happened.

The Phase II suspension did not touch the self-assessment obligation. The department’s own July 13 release announcing the suspension says all Phase I self-assessment requirements remain firmly in place, and that during the interim the department will enforce NIST SP 800-171 Rev 2 “through self-assessments and select government-led assessments.” That is the citation behind my closing paragraph, and it is the department’s announcement rather than a roundup of it.

The $47,000 figure is not a refutation of the SBA administrator’s $600,000. They measure different scopes, and the smaller number comes from the subset of respondents who cited a figure, as the department’s own summary notes.

“No” in the GCC column means unavailable in GCC as of the October 1 table. It is not a queue position I can schedule around. Directions expects some features never to arrive in the government tiers at all, and the service description page says nothing about when the No rows move. Agent 365 is also not FedRAMP authorized yet: Microsoft says it met all FedRAMP High controls reviewed by its independent third-party assessor as of October 1, with final authorization by its accrediting agency pending.

This is a Microsoft-shaped post because the department’s own RFI summary names Microsoft 365 GCC High first among licensing costs, which makes the example the one the regulated population is paying for. The general claim is the tier-gap rule, and it applies to whatever platform sits in your system security plan. I would ask the same three questions of any of them: which of the evidence capabilities are in the tier I am authorized to use, what does the contract require the provider to give me instead, and what am I doing while I wait.

Nothing here says contractors should hold off on Copilot in GCC High. That reading would be wrong, and I have already argued the opposite case for local inference where the workload allows it. The point is narrower: the assistant is inside the boundary in every tier where Copilot runs, the compliance capability that would document what it did is marked absent in the one tier Microsoft provides a table for, and is undocumented in the tiers above. Until somebody shows you the list for your tenant, the record is yours to assemble.

Bottom line

The department’s own RFI data says the cost of CMMC is the cost of implementing NIST SP 800-171 and assembling the evidence to prove it. Its reform package answers with clearer CUI marking and machine-readable assessment evidence. Both would be easier with a label a machine can read, which is the inference I flagged earlier and not something the summary says. On the one published availability table, the compliance rows for agents are exactly the rows marked unavailable in the tier they are documented for, and nothing is published for the tiers above. A contractor cannot wait for that to resolve, because the July 13 suspension covered the Phase II assessments and left the Phase I self-assessment requirement in place. Label the data, restrict what agents can reach with the controls your licence actually includes, and keep a dated record of what you could not yet produce.

Sources

  1. DoD’s reasons for CMMC pause falling apart in face of RFI responses — Jason Miller, Federal News Network, October 26, 2026
  2. RFI offers path forward for DoD with CMMC — Jason Miller, Federal News Network, October 27, 2026
  3. Microsoft Agent 365 — Service Descriptions — Microsoft Learn, last updated October 1, 2026
  4. Microsoft 365 G7 Is Here. Mostly. Sort Of. — Wes Miller, Directions on Microsoft, October 14, 2026
  5. What’s Next in Microsoft 365 Copilot for Government — Microsoft Public Sector Blog, September 15, 2026
  6. Controlled Unclassified Information Markings (CUI training aid, DOPSR 25-P-0275) — OUSD(I&S), December 2024
  7. CMMC and AI Governance: How to Keep CUI Out of AI Tools — Roberto Araiza, Fortra, October 6, 2026
  8. Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements — U.S. Department of War, July 13, 2026