Label and review external sharing
A person checks a proposed sharing decision and its evidence.
Coming
See every demonstrationFREE CHECK
CMMC readiness
Map the contract boundary and evidence ownership before an assessment.
01 Source02 Boundary03 Human decision04 Evidence
WHAT TO REVIEW
Four questions for the team that owns the decision.
- Is the controlled unclassified information boundary documented?
- Can each applicable control be tied to an owner?
- Are evidence sources and review dates recorded?
- Are supplier flowdown duties identified?
Take the PDF with you.
Enter a work email, company and role to request the PDF. This action records an SIT inquiry for follow-up. Marketing emails require a separate choice.
Download the PDF directlyTHE CHECK
What does the CMMC readiness check test?
Whether the controlled unclassified information boundary is documented, whether each applicable control has an owner, whether evidence sources and review dates are recorded, and whether supplier flowdown duties are identified.
Four questions on the contract boundary, control ownership and evidence, with a PDF you can download directly and no email required. Readiness, not certification: Simplicity IT does not certify anyone.
THE MICROSOFT INSIGHT
Where does the evidence for the controls come from in a Microsoft tenant?
From the policies you already run: Microsoft Purview Insider Risk Management, for example, ships policy templates whose alerts and records are evidence an assessor can read.
Microsoft Purview Insider Risk Management ships a Risky AI usage policy template that scores prompts and responses containing sensitive information in Microsoft 365 Copilot and agents, and browsing to generative AI sites. (Microsoft Learn, checked Oct 31, 2026)
Map each control to the policy that produces its evidence and the assessment is a review. Map nothing and the assessment is an excavation.
THE METHOD
How does the check turn into an evidence map?
Each question draws one line of the map: the boundary, the owner per control, the evidence source and date, and the supplier duties that flow down.
- Boundary: where controlled unclassified information lives and where it must not go.
- Owner: a named person for each applicable control.
- Evidence: the source and the review date for each control, recorded.
- Flowdown: the duties your suppliers carry, identified and tracked.
THE AI QUESTION
Do AI agents change the CMMC boundary?
Yes, because an agent that can reach controlled information is inside the boundary, so it needs an owner, an identity and a permission row like any other system.
Microsoft Agent 365 is the control plane that observes, governs and secures agents built on Microsoft platforms or acquired from third parties, through the Microsoft 365 admin center, Microsoft Entra, Microsoft Purview and Microsoft Defender. (Microsoft Learn, checked Oct 31, 2026)
Inventory the agents inside the boundary now and the assessor sees a list. Leave them and the assessor finds them.
THE NEXT RUNG
What comes after the check?
A read-only readiness assessment that tests each control's evidence inside your tenant and produces the Tested or Assumed record you take into the formal assessment.
Scoped separately from remediation, quoted after a scoping call. Readiness only; certification is the assessor's to grant.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold the PDF and the four lines of the map are marked tested or assumed.
- The controls without an owner are listed.
- The evidence sources without a review date are listed.
- You have booked, or decided not to book, the read-only readiness assessment.
HONEST ABOUT LIMITS
What this does not do yet
It does not cover the evidence an agent with its own account keeps in memory. Copilot Studio agents with their own account, a Frontier preview, keep a shared memory that users cannot opt out of and admins cannot switch off separately from agent accounts; memories are deleted after 28 days without interaction. (Microsoft Learn, checked Oct 31, 2026, preview) That Frontier preview is recorded as a boundary question for the next register refresh.
It does not certify you: readiness only, and the firm makes no certification claim on your behalf.
It does not create a lead unless you ask for the PDF by email and say so.
THE ONE THING TO REMEMBER
Boundary, owner, evidence, flowdown: four lines of a map you draw before the assessor arrives.
Said another way: readiness is knowing which control is assumed before someone else proves it.
Said a third way: an agent inside the boundary is a system inside the boundary.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
Does Simplicity IT certify CMMC?
No. The check and the assessment are readiness work. Certification is granted by an assessor, and the firm makes no certification claim for any client.
Is the PDF gated?
No. Download it directly. Asking for it by email is optional and creates an inquiry; marketing email is a separate box.
What counts as evidence?
A record produced by a control you run, with a source and a review date: a policy alert, an access review, an approval record, a configuration export. The map ties each control to one.
Do our AI agents matter for CMMC?
Yes, if they can reach controlled unclassified information. They then need an owner, an identity and a permission row, and they appear on the evidence map.
How is the assessment priced?
Quoted after a scoping call, scoped separately from remediation.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.