DIB contractors that use Microsoft cloud services may only need to meet a small portion of CMMC's 110 controls after the cloud provider passed its voluntary assessment.

The accreditation body also issued a draft document detailing the assessment process that third-party assessment organizations will need to follow once the final CMMC rule takes effect.