Controls live in configuration, not in binders
Most of NIST SP 800-171's technical requirements resolve to specific, testable configuration in the Microsoft stack. Access control lives in Conditional Access policy. Media protection and CUI flow control live in Purview labels and DLP. Endpoint hardening lives in Intune baselines and WDAC. An assessor doesn't read your policy PDF and nod — they ask to see the configuration and the logs. That's what we engineer.
The six planes
- Entra ID governance — least privilege, MFA enforcement (§3.5.3 — a five-point control), session control, and a policy set that's auditable rather than accreted.
- Intune endpoint baselines — hardened configuration profiles, compliance policies, and patching pipelines mapped to §§3.4.x configuration-management objectives.
- Purview labeling & DLP — CUI identified, labeled, and technically prevented from leaving the boundary — the enforcement layer that turns your data-flow diagram into fact.
- Defender — detection and response wired to §3.6.x incident-response objectives, including the DFARS 72-hour reporting clock. See our DFARS incident-response article.
- WDAC application control — allow-listing that closes the software-execution gap most environments leave open.
- Audit & logging architecture — §3.3.x collection, retention, review, and correlation designed so evidence generation is a byproduct of operations.
Questions contractors ask us
What are the 'six Microsoft security planes'?
Entra ID, Intune, Purview, Defender, WDAC, and audit and logging — the six layers where 800-171 controls actually get implemented in a Microsoft shop, whether the tenant is GCC High or commercial M365. Engineered separately they drift and contradict; engineered as one system they satisfy overlapping control families with shared evidence.
Is this a one-time hardening project or ongoing?
Both exist. The initial engineering runs as Factory station 02–03 (design, deploy, document). Keeping it compliant — evidence refresh, drift detection, control validation — is managed compliance. Certification is a state to operate, not a milestone to frame.
We already have an MSP. Can you work alongside them?
Yes — and if your MSP touches CUI or security functions, they're inside your assessment scope under shared responsibility. Part of advisory work is making that boundary explicit: who holds which controls, and whose evidence proves it.
Get the six planes engineered as one system.
Tell us what you run and where it hurts — misconfigurations, audit findings, or a score that won't move. Or email rj@indirectit.com directly.