Controls live in configuration
Most of NIST SP 800-171's technical requirements come down to specific, testable configuration in the Microsoft stack. Access control is set in Conditional Access policy, media protection and CUI flow control in Purview labels and DLP, and endpoint hardening in Intune baselines and WDAC. An assessor will ask to see the configuration and the logs behind each control, and those are what we engineer.
The six planes
- Entra ID governance covers least privilege, MFA enforcement (§3.5.3, a five-point control), session control, and a policy set that stays auditable as it grows.
- Intune endpoint baselines provide hardened configuration profiles, compliance policies, and patching pipelines mapped to the §§3.4.x configuration-management objectives.
- Purview labeling and DLP identify and label CUI and technically block it from leaving the boundary, which makes your data-flow diagram true in practice.
- Defender handles detection and response, wired to the §3.6.x incident-response objectives and the DFARS 72-hour reporting deadline. See our DFARS incident-response article.
- WDAC application control allow-lists software, which closes the execution gap most environments leave open.
- Audit and logging architecture sets up §3.3.x collection, retention, review, and correlation so that normal operations generate the evidence.
Questions contractors ask us
What are the 'six Microsoft security planes'?
They are Entra ID, Intune, Purview, Defender, WDAC, and audit and logging: the six layers where 800-171 controls get implemented in a Microsoft shop, whether the tenant is GCC High or commercial M365. Engineered separately, they drift and contradict each other. Engineered as one system, they satisfy overlapping control families with shared evidence.
Is this a one-time hardening project or ongoing?
Both. The initial engineering runs as Factory stations 02 and 03 (design, deploy, document). Keeping it compliant after that, through evidence refresh, drift detection, and control validation, is ongoing managed compliance work.
We already have an MSP. Can you work alongside them?
Yes. If your MSP touches CUI or security functions, it is inside your assessment scope under shared responsibility. Part of the advisory work is making that boundary explicit: who holds which controls, and whose evidence proves it.
Get the six planes engineered as one system.
Tell us what you run and where it hurts, whether that's misconfigurations, audit findings, or a score that won't move. Or email rj@indirectit.com directly.