Background
Your Secureframe Defense enclave includes a Microsoft 365 GCC High tenant. During the GCC High navigator flow, Secureframe applies a set of email and data protection controls to that tenant. These controls cover CMMC Level 2 requirements for protecting Controlled Unclassified Information (CUI) in transit and preventing CUI from leaving your environment.
Every one of these controls depends on the CUI sensitivity label. When a user labels an email as CUI, Microsoft 365 knows to check where it's going, encrypt it, and send it securely.
By default, CUI-labeled email can't be sent outside your organization. If you share CUI with approved partners, you can allow their email domains. Email to those partners is then protected in two ways:
Forced TLS encrypts the connection between mail servers. It protects the email only while it travels. Once delivered, the email is stored unencrypted on the recipient's server.
Purview Message Encryption encrypts the email itself. It stays encrypted in transit, on every server, and in the recipient's mailbox, and only the intended recipient can open it.
CUI email flow
A user applies the CUI label in Outlook. The email gets a visible CUI header and footer along with a hidden header that identifies the label.
The data loss prevention (DLP) policy checks the recipients. If any recipient is outside your organization and their domain isn't an approved exception, the email is blocked.
The "Encrypt CUI" rule encrypts the body and attachments with Purview Message Encryption.
If the email is going to an outside recipient and has "CUI" or "CONTROLLED" in the subject line, it's sent through the forced-TLS connector. If the recipient's mail server can't make an encrypted connection, the email isn't sent, and the sender gets a delivery failure notice.
What Secureframe configures
CUI sensitivity label
A label called "CUI" for files and email. It adds a red header ("CUI - CONTROLLED UNCLASSIFIED INFORMATION"), a red footer ("This document contains CUI. Handle per NIST SP 800-171."), and a diagonal "CUI" watermark.
It's available to all users through the "CUI Label Policy." Users apply the label themselves. The label marks content but doesn't encrypt it on its own.
Data loss prevention
A DLP policy called "CMMC Block CUI External" for Exchange email, SharePoint, and OneDrive. Its rule, "Block CUI to External," blocks CUI-labeled email and files from being sent or shared outside your organization.
When it blocks a CUI-labeled email or file share, the site admin and the person who last edited the file are notified, and the site admin gets an incident report. A separate alert, "DLP Match Alert," notifies your admins every time the policy is triggered.
By default, every outside recipient is blocked. The policy doesn't cover Microsoft Teams, because Microsoft doesn't support label-based DLP rules for Teams chats and channels.
Forced TLS
An outbound connector called "Require TLS to Partners," which only delivers email over an encrypted (TLS) connection, and a mail flow rule called "Route CUI to TLS Connector," which sends email to outside recipients through that connector when the subject contains "CUI" or "CONTROLLED."
Microsoft manages the TLS versions and cipher suites in Exchange Online, and there's no tenant setting to change them. Microsoft turned off TLS 1.0 and 1.1 for Microsoft 365 GCC High on January 15, 2020, to meet FedRAMP requirements.
Purview Message Encryption
A mail flow rule called "Encrypt CUI." When an email has the CUI label, the rule encrypts it with Purview Message Encryption and requires TLS when it's sent.
This message-level TLS requirement is separate from the forced-TLS connector.
Recipients inside GCC High read the email normally in Outlook. Recipients outside GCC High, including commercial Microsoft 365, Gmail, and Outlook users, get an email with a link to Microsoft's encrypted message portal, where they can read and reply.
The rule starts in audit mode: Exchange logs which emails match, but doesn't encrypt them until the rule is switched to Enforce.
Forwarding and legacy protocols
Mail flow rules reject auto-forwarded and mailbox-forwarded email sent to outside recipients, so CUI can't leave through a forwarding rule. Auto-forwarding is also turned off on the default remote domain. SMTP AUTH is turned off for the whole tenant, and POP and IMAP are turned off on the default mailbox plan.
What your team does
Turn on message encryption. In the Exchange admin center, go to Mail flow > Rules, open "Encrypt CUI," and on the Settings tab set Rule mode to Enforce, then save. This applies to all CUI-labeled email, including email between your own users.
Train users to label CUI. Users need to apply the CUI label to every CUI file and email. Encryption and DLP both depend on it.
Use the subject line. Put "CUI" or "CONTROLLED" in the subject line of CUI email, so email to outside recipients goes through the forced-TLS connector.
Allow approved partners. If you share CUI with partners, add their email domains as exceptions. In the Microsoft Purview portal, go to Data loss prevention > Policies, edit "CMMC Block CUI External," open the "Block CUI to External" rule, and add an exception for Recipient domain.
Confirm Azure Rights Management is active. Run Get-IRMConfiguration in Exchange Online PowerShell and check that AzureRMSLicensingEnabled is True. New GCC High tenants on G3 or G5 have it on by default.
Optional:
Turn on mandatory labeling, and require a justification to remove or downgrade a label, in the "CUI Label Policy." With mandatory labeling, users can change a label but can't remove it. Secureframe doesn't configure these settings.
If CUI moves through Teams or endpoint devices, add your own DLP coverage there. Secureframe's policy covers Exchange, SharePoint, and OneDrive only.