Blog
Writing from the Cloud Kings team
Practical notes on Azure, Microsoft 365, security, and compliance — written when we have something worth saying rather than to a content calendar.
-
Compliance
What CMMC Level 2 actually costs
The five things you are actually paying for, why scope moves the number more than anything else, and why we will not publish a figure.
-
Compliance
Your SPRS score, and why it is negative
How the NIST SP 800-171 self-assessment score is calculated, why a negative number is normal rather than alarming, and who is actually reading it.
-
Compliance
GCC High or Commercial — which do you need?
For a defense contractor the real choice is between two Microsoft 365 environments. What decides it, and why GCC High is not automatically the safer answer.
-
Compliance
What actually counts as CUI?
The question that decides whether you owe 15 basic safeguarding requirements or all 110 controls — and why unmarked information is the trap that catches people.
-
Compliance
The CMMC controls nobody owns
Most contractors don't fail on the controls they got wrong. They fail on the ones both parties assumed the other had. Free matrix template inside.
-
Compliance
CMMC Phase II is suspended. Your signature got heavier.
The third-party certification requirement is on hold. Your safeguarding clauses, your SPRS affirmation, and your prime's flowdowns are not.
-
Compliance
How to choose a CMMC partner
The questions that actually produce different answers from different providers — plus the ones every provider passes, and the red flags worth walking away from.
-
Azure Virtual Desktop
Ten reasons to use Azure Virtual Desktop, and three not to
Ten reasons Azure Virtual Desktop is worth deploying, with the caveat attached to each — and three situations where it is the wrong answer.
-
Azure Virtual Desktop
What is Azure Virtual Desktop?
What Azure Virtual Desktop actually is, how it differs from a VPN and from Windows 365, when it is the right answer, and when it is not.