--- title: Is Office 365 NIST 800-171 Compliant? description: By using the Data Loss Prevention (DLP) feature of Office 365, you can address compliance objectives for CMMC and NIST. image: https://blog.corserva.com/hubfs/engineers-manufacturing-400x200.jpg --- ![Office 365 NIST CMMC](https://blog.corserva.com/hs-fs/hubfs/engineers-manufacturing-400x200.jpg?width=300&name=engineers-manufacturing-400x200.jpg) [Sean McCloat, CISSP](https://blog.corserva.com/author/sean-mccloat-cissp)February 7, 20182 min read # Leveraging Microsoft Office 365 to Comply with NIST 800-171 & CMMC [Previous ](https://blog.corserva.com/it-asset-recovery-services) [Next ](https://blog.corserva.com/20-ways-to-improve-your-security-posture) Depending on the customers you serve and the industry in which you operate, there may be mandates to which you must comply in regard to the security of data. ## Example Mandates Dictating Security Controls For example: **Prime contractors** — The [NIST 800-53](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) mandate describes security controls that must be in place for any US federal information system. Companies doing business directly with the government, such as DoD contractors, must follow this mandate. **Subcontractors** — [NIST 800-171](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf) and CMMC dictate that any company providing equipment or services to suppliers that serve the government [(including subcontractors)](https://blog.corserva.com/3-myths-about-nist-compliance) must comply with [NIST 800-171 or CMMC](https://info.corserva.com/nist-compliance-the-definitive-guide) (depending on the contract) to protect unclassified information. **Healthcare organizations** — The [HIPAA](https://www.gpo.gov/fdsys/pkg/STATUTE-110/pdf/STATUTE-110-Pg1936.pdf) law requires that patient health information be encrypted, and that healthcare organizations take steps to prevent security breaches. **Other** — Other industries have regulations for personally identifiable information (PII), social security numbers, credit card information, and other sensitive data.   [![NIST and CMMC](https://no-cache.hubspot.com/cta/default/3788695/2996c11d-d1a1-45cb-ae41-0d1f63f77b7b.png)](https://cta-redirect.hubspot.com/cta/redirect/3788695/2996c11d-d1a1-45cb-ae41-0d1f63f77b7b)   By using the **Data Loss Prevention (DLP) feature of Office 365**, you can identify, monitor, and automatically protect sensitive information across Office 365.   ## **Office 365 Data Loss Prevention (DLP) Feature** As shown on [this pricing sheet](https://blog.corserva.com/hubfs/corserva-microsoft-office-365-plans.pdf) listing features of the various Microsoft Office 365 packages, Enterprise versions of the platform include an "Information Protection" feature (including Rights Management and Data Loss Prevention for email messages). By leveraging the Microsoft DLP feature, you can make significant progress down the path to meeting your compliance goals. [![corserva-microsoft-office-365-plans](https://blog.corserva.com/hs-fs/hubfs/corserva-microsoft-office-365-plans.png?width=707&name=corserva-microsoft-office-365-plans.png)](https://blog.corserva.com/hubfs/corserva-microsoft-office-365-plans.pdf) The DLP feature of Office 365 enables you to: - Identify stored documents that contain credit card numbers - Prevent your users from accidentally sharing confidential information with those outside the company - Help users stay compliant without interrupting their workflow   ## **The Advantages of DLP** Unlike a simple text scan, the DLP feature leverages **deep content analysis** to perform keyword matches, dictionary matches, the evaluation of regular expressions, internal functions, and other methods to detect content that matches your DLP policies. The solution is less intrusive than others because by protecting only the information considered sensitive, fewer people are affected. The DLP feature protects content in: - Exchange Online - OneDrive for Business sites - SharePoint Online sites - Office 2016 desktop programs (Excel 2016, PowerPoint 2016, and Word 2016)   ## **Getting Started with DLP** If you are interested in learning more about the DLP feature in Microsoft Office 365 and other native features you can leverage, [Corserva can help](https://info.corserva.com/get-quote-office-365-migration-services). We can [migrate your organization to Office 365](https://www.corserva.com/migration-services-to-microsoft-office-365/) (if you're not already there) and manage your installation as part of a managed services plan. We also offer [advanced email security service plans](https://www.corserva.com/email-security/) that leverage **machine learning techniques** to protect your users from the most sophisticated phishing and malware attacks. Contact us to learn more. [![GET A QUOTE](https://no-cache.hubspot.com/cta/default/3788695/d54a8a5a-5afe-4bc4-a2a0-eff5da821ca0.png)](https://cta-redirect.hubspot.com/cta/redirect/3788695/d54a8a5a-5afe-4bc4-a2a0-eff5da821ca0)   [![RPO](https://blog.corserva.com/hs-fs/hubfs/rpo-1.png?width=200&name=rpo-1.png)](https://www.corserva.com/cmmc-readiness/)Corserva is a CMMC-AB Registered Provider Organization™ (RPO) and we are [listed on the CMMC-AB Marketplace](https://portal.cmmcab.org/marketplace/corserva-inc/). As an RPO, Corserva is authorized by the CMMC Accreditation Body to provide pre-assessment consulting services to government contractors and other Organizations Seeking Certification (OSC).   ![avatar](https://blog.corserva.com/hs-fs/hubfs/bios/sean-mccloat-400x400.jpg?width=290&name=sean-mccloat-400x400.jpg) #### [Sean McCloat, CISSP](https://blog.corserva.com/author/sean-mccloat-cissp) Sean is responsible for Corserva’s network and security operations centers, field services, sales engineering, data center operations, and professional services. He has an intense focus on delivering exceptional customer service across a wide array of client engagements. With 25+ years of national and global experience in the IT industry, Sean has real world experience at the corporate and enterprise levels of healthcare, advertising, and logistics organizations. In addition to his CISSP certification, Sean is a CMMC-AB Registered Practitioner (RP). He leads Corserva’s assessment and compliance team, guiding companies in meeting business objectives with NIST 800-171 and CMMC. ## RELATED ARTICLES ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "United States", "addressLocality" : "Trumbull", "addressRegion" : "CT", "postalCode" : "06611", "streetAddress" : "100 Technology Drive" }, "email" : "hello@corserva.com", "knowsLanguage" : "en-us", "logo" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/3788695/corserva-logo.png" }, "name" : "Corserva", "telephone" : "+1 203 452 8500", "url" : "https://blog.corserva.com/office-365-nist-800-171" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "abstract" : "By using the Data Loss Prevention (DLP) feature of Office 365, you can address compliance objectives for CMMC and NIST.", "author" : { "@type" : "Person", "name" : "Sean McCloat, CISSP" }, "dateModified" : "December 15, 2021 7 PM", "datePublished" : "February 7, 2018 2 PM", "headline" : "Leveraging Microsoft Office 365 to Comply with NIST 800-171 & CMMC", "image" : "https://info.corserva.com/hubfs/engineers-manufacturing-400x200.jpg", "inLanguage" : "en-us", "keywords" : "[NIST & CMMC, Office 365 & Microsoft 365]", "mainEntityOfPage" : { "@type" : "WebPage" }, "name" : "Leveraging Microsoft Office 365 to Comply with NIST 800-171 & CMMC", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/3788695/corserva-logo.png" }, "name" : "Corserva" }, "text" : "Depending on the customers you serve and the industry in which you operate, there may be mandates to which you must comply in regard to the security of data. Example Mandates Dictating Security Controls For example: Prime contractors — The NIST 800-53 mandate describes security controls that must be in place for any US federal information system. Companies doing business directly with the government, such as DoD contractors, must follow this mandate. Subcontractors — NIST 800-171 and CMMC dictate that any company providing equipment or services to suppliers that serve the government (including subcontractors) must comply with NIST 800-171 or CMMC (depending on the contract) to protect unclassified information. Healthcare organizations — The HIPAA law requires that patient health information be encrypted, and that healthcare organizations take steps to prevent security breaches. Other — Other industries have regulations for personally identifiable information (PII), social security numbers, credit card information, and other sensitive data. By using the Data Loss Prevention (DLP) feature of Office 365, you can identify, monitor, and automatically protect sensitive information across Office 365. Office 365 Data Loss Prevention (DLP) Feature As shown on this pricing sheet listing features of the various Microsoft Office 365 packages, Enterprise versions of the platform include an \"Information Protection\" feature (including Rights Management and Data Loss Prevention for email messages). By leveraging the Microsoft DLP feature, you can make significant progress down the path to meeting your compliance goals. The DLP feature of Office 365 enables you to: Identify stored documents that contain credit card numbers Prevent your users from accidentally sharing confidential information with those outside the company Help users stay compliant without interrupting their workflow The Advantages of DLP Unlike a simple text scan, the DLP feature leverages deep content analysis to perform keyword matches, dictionary matches, the evaluation of regular expressions, internal functions, and other methods to detect content that matches your DLP policies. The solution is less intrusive than others because by protecting only the information considered sensitive, fewer people are affected. The DLP feature protects content in: Exchange Online OneDrive for Business sites SharePoint Online sites Office 2016 desktop programs (Excel 2016, PowerPoint 2016, and Word 2016) Getting Started with DLP If you are interested in learning more about the DLP feature in Microsoft Office 365 and other native features you can leverage, Corserva can help. We can migrate your organization to Office 365 (if you're not already there) and manage your installation as part of a managed services plan. We also offer advanced email security service plans that leverage machine learning techniques to protect your users from the most sophisticated phishing and malware attacks. Contact us to learn more. Corserva is a CMMC-AB Registered Provider Organization™ (RPO) and we are listed on the CMMC-AB Marketplace. As an RPO, Corserva is authorized by the CMMC Accreditation Body to provide pre-assessment consulting services to government contractors and other Organizations Seeking Certification (OSC).", "url" : "https://blog.corserva.com/office-365-nist-800-171", "wordCount" : "2708" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Sean McCloat, CISSP", "url" : "https://blog.corserva.com/author/sean-mccloat-cissp" }, "dateModified" : "2021-12-15T19:30:35.008Z", "datePublished" : "2018-02-07T14:41:00.000Z", "headline" : "Is Office 365 NIST 800-171 Compliant?", "image" : [ "https://blog.corserva.com/hubfs/engineers-manufacturing-400x200.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.corserva.com/office-365-nist-800-171", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.corserva.com/hubfs/corserva-logo.png" }, "name" : "Corserva" } } ``` ```json { "@context" : "http://schema.org", "@type" : "Article", "MainEntityOfPage" : "https://blog.corserva.com/office-365-nist-800-171", "aggregateRating" : { "@type" : "AggregateRating", "ratingCount" : "1", "ratingValue" : "5" }, "articleBody" : "Depending on the customers you serve and the industry in which you operate, there may be mandates to which you must comply in regard to the security of data.

Example Mandates Dictating Security Controls

For example:

Prime contractors — The NIST 800-53 mandate describes security controls that must be in place for any US federal information system. Companies doing business directly with the government, such as DoD contractors, must follow this mandate.

Subcontractors — NIST 800-171 dictates that any company providing equipment or services to suppliers that serve the government (including subcontractors) must comply with this mandate to protect unclassified information. Read "The Definitive Guide to Compliance with the NIST 800-171 Mandate" to learn more about NIST 800-171 compliance.

Healthcare organizations — The HIPAA law requires that patient health information be encrypted, and that healthcare organizations take steps to prevent security breaches.

Other — Other industries have regulations for personally identifiable information (PII), social security numbers, credit card information, and other sensitive data.

\"Read

By using the Data Loss Prevention (DLP) feature of Office 365, you can identify, monitor, and automatically protect sensitive information across Office 365.

Office 365 Data Loss Prevention (DLP) Feature

As shown on this pricing sheet listing features of the various Microsoft Office 365 packages, Enterprise versions of the platform include an "Information Protection" feature (including Rights Management and Data Loss Prevention for emails). By leveraging this feature, you can make significant progress down the path to meeting your compliance goals.

\"Office

The DLP feature of Office 365 enables you to:

\"Microsoft

The Advantages of DLP

Unlike a simple text scan, the DLP feature leverages deep content analysis to perform keyword matches, dictionary matches, the evaluation of regular expressions, internal functions, and other methods to detect content that matches your DLP policies.

The solution is less intrusive than others because by protecting only the information considered sensitive, fewer people are affected.

The DLP feature protects content in:

\"NIST

Getting Started with DLP

If you are interested in learning more about the DLP feature in Microsoft Office 365 and other native features you can leverage, Corserva can help.

We can migrate your organization to Office 365 (if you're not already there) and manage your installation as part of a managed services plan.

We also offer advanced email security service plans that leverage machine learning techniques to protect your users from the most sophisticated phishing and malware attacks. Contact us to learn more.", "articleSection" : "NIST", "author" : { "@type" : "Person", "name" : "Sean McCloat, CISSP" }, "dateModified" : "2018-02-07", "datePublished" : "2018-02-07", "headline" : "Leveraging Microsoft Office 365 to Comply with NIST 800-171", "image" : "https://blog.corserva.com/hs-fs/hubfs/engineers-manufacturing.jpg?width=710&name=engineers-manufacturing.jpg", "name" : "Leveraging Microsoft Office 365 to Comply with NIST 800-171", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "name" : "Corserva", "url" : "https://info.corserva.com/hubfs/corserva-logo-no-tagline.png" }, "name" : "Corserva" }, "url" : "https://blog.corserva.com/office-365-nist-800-171" } ``` ```json { "@context" : "http://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "United States", "addressLocality" : "Trumbull", "addressRegion" : "CT", "postalCode" : "06611", "streetAddress" : "100 Technology Drive " }, "alternateName" : "Corserva", "areaServed" : { "@type" : "GeoCircle", "geoMidpoint" : { "@type" : "GeoCoordinates", "latitude" : "41.296953", "longitude" : "-73.229171" }, "geoRadius" : "150 km" }, "description" : "IT Managed Services", "email" : "sales@corserva.com", "image" : "https://info.corserva.com/hubfs/corserva-logo.png", "logo" : "https://cdn2.hubspot.net/hubfs/3788695/corserva-logo.png", "mainEntityOfPage" : { "@id" : "https://blog.corserva.com/office-365-nist-800-171", "@type" : "WebPage", "description" : "By using the Data Loss Prevention (DLP) feature of Office 365, you can address compliance objectives for CMMC and NIST." }, "naics" : "423430", "name" : "Corserva", "sameAs" : [ "https://www.facebook.com/corserva/", "https://twitter.com/Corserva", "https://www.linkedin.com/company/corserva/", "https://www.youtube.com/channel/UCahxftAl1XZ_ZJNZzS8VINQ", "https://plus.google.com/b/107801827072544428319/+Corserva" ], "telephone" : "8553303976", "url" : "https://www.corserva.com" } ```