EPC Group issues GCC High Fabric checklist as CMMC pause reshapes defense planning

EPC Group published a nine-point checklist for defense contractors considering Microsoft Fabric in GCC High as Microsoft made the platform generally available there on Oct. 1, 2026. The guidance lands while the Department of War has paused the CMMC Phase 2 transition, giving contractors a window to build analytics and compliance evidence inside the boundary before deadlines return.

Why it matters: - Defense contractors can now place more analytics workloads inside GCC High, but the CMMC Phase 2 pause does not loosen NIST SP 800-171 obligations. - The timing creates a planning window for contractors that want their data, identity, logging and governance controls in place before third-party certification timelines restart. - A poor rollout could leave analytics platforms outside the assessment boundary, with less time to fix scope, labeling and evidence gaps later.

What happened: - EPC Group, a Houston-based Microsoft consulting firm founded in 1997, published a nine-point data-foundation checklist for defense contractors evaluating Microsoft Fabric in GCC High. - Microsoft made Fabric generally available in GCC High on Oct. 1, 2026, after a public preview that began Sept. 2, 2026. - The Department of War suspended the planned November 2026 transition to CMMC Phase 2 on July 13, 2026, and has not restored a start date. - EPC Group said contractors should answer the nine checklist questions in writing before provisioning the first Fabric capacity.

The details: - Microsoft said Fabric feature availability in GCC High varies by workload and expands over time, so not every Fabric capability is available at launch. - The source announcement points contractors to the Microsoft Learn supported-features list for GCC High availability by workload, including lakehouse, warehouse, Real-Time Intelligence, data pipelines, mirroring, Copilot and Fabric IQ. - GCC High is Microsoft’s cloud environment for U.S. defense contractors and agencies handling Controlled Unclassified Information and export-controlled data. - Fabric brings OneLake, lakehouse and warehouse workloads, Real-Time Intelligence, data pipelines and Power BI into one platform and one capacity model in GCC High, subject to workload-by-workload limits. - The July 13 suspension memo says the Department will enforce baseline compliance with NIST SP 800-171 Rev. 2 through CMMC Level 1 and Level 2 self-assessment and select Government-led assessments. - A Sept. 3, 2026 class deviation made the suspension binding on contracting officers. - DFARS 252.204-7012 remains in force, NIST SP 800-171 Revision 2 remains the assessed baseline, self-assessment scores still must be posted to the Supplier Performance Risk System, and 32 CFR Part 170 remains active. - EPC Group’s checklist says contractors should confirm workload availability in GCC High, decide whether the Fabric workspace is inside the assessment scope, map identity before data, apply Microsoft Purview sensitivity labels, route Fabric and OneLake audit events into logging, set capacity overage posture, treat agents as principals, sequence the first workload by evidence value and plan the exit from any commercial-cloud analytics estate. - The checklist says workspaces, capacity and administrators are in scope for Level 2 assessment if CUI lands in OneLake. - The checklist also says Fabric inherits Microsoft Entra identity in GCC High, so conditional access, privileged identity management and access reviews should extend to Fabric roles, capacity admins and OneLake shortcuts. - EPC Group says Fabric and OneLake audit events should be retained and reviewed as part of the System Security Plan. - The firm says Microsoft’s capacity overage feature is in preview and bills excess compute at a multiple of pay-as-you-go rates, with an administrator-set daily limit. - EPC Group says previewed agents should be treated as non-human identities with approved-action lists, owners, workspace scope and logs. - The firm recommends starting with the workload already creating a finding or manual handoff, such as Power BI reporting from file shares or a governed evidence-reporting layer. - EPC Group’s companion guidance says contractors with Power BI Premium or Fabric in the commercial tenant should document what moves, what retires and what remains, with dates.

Between the lines: - The pause on CMMC Phase 2 appears to be changing contractor behavior from deadline-driven compliance to controlled preparation. - Microsoft’s GCC High launch gives defense customers a more governed analytics option, but only if they verify feature availability and scope each workload carefully. - The checklist reflects a broader shift in CMMC: analytics platforms are being treated less like isolated tools and more like in-scope systems that can affect identity, logging, labeling and evidence collection. - EPC Group is also using the release to position its own readiness framework, TAR-8, as a prerequisite for AI and analytics deployments in regulated tenants.

What's next: - Contractors are likely to spend the Oct. 1 to Dec. 31 window mapping scope, labels, identity controls, logs and capacity decisions before renewal cycles and future CMMC milestones return. - EPC Group says contractors should run its TAR-8 readiness score before the first Fabric capacity is provisioned. - Defense contractors and agencies can request a GCC High, Fabric and CMMC scoping call if they want the checklist applied to their tenant.

The bottom line: - Fabric is now available in GCC High, but the real decision for defense contractors is not whether to adopt it — it is whether they can do so inside a documented CMMC-ready boundary before the compliance clock starts again.