Microsoft Fabric Reaches GA in GCC High as CMMC Phase 2 Suspension Provides Compliance Window

Microsoft Fabric has reached general availability (GA) in the GCC High environment on October 1, 2026, marking a significant milestone for U.S. defense contractors and agencies handling Controlled Unclassified Information (UCI) and export-controlled data. This development comes as the Department of War has suspended the November 10, 2026, transition to Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program, effective July 13, 2026, and has yet to restore a start date.

The suspension of CMMC Phase 2 has provided a unique window for contractors to strategically plan their compliance efforts.

EPC Group, a consulting firm founded on March 30, 1997, and now in its 26th year of operation, has published a GCC High Data-Foundation Checklist to guide contractors through the process. The checklist, designed for those planning to move Power BI reporting, security telemetry analytics, or program data into Fabric in GCC High during the pause, includes nine essential steps. These steps range from confirming the workload's availability in GCC High to setting the capacity posture in writing and treating agents as principals.

One of the key points in the checklist is to map identity before data. Fabric inherits Microsoft Entra identity in GCC High, and contractors must ensure that conditional access, privileged identity management, and the access-review cadence required under NIST SP 800-171 extend to Fabric workspace roles, capacity admins, and OneLake shortcuts. A shortcut to an external source is an access path an assessor will trace.

Another critical aspect is the application of Microsoft Purview sensitivity labels to the semantic models and lakehouses that will hold UCI. Contractors must confirm that the Purview controls, such as sensitivity-label inheritance and data-loss-prevention policies, are available in GCC High before relying on them.

EPC Group also emphasizes the importance of routing Fabric and OneLake audit events into the logging and monitoring evidence trail. NIST SP 800-171 audit and accountability requirements do not exempt a new platform. Contractors must decide where Fabric activity logs land, how long they are retained, and who reviews them, and record this in the System Security Plan.

Setting the capacity posture in writing is another crucial step. Microsoft's capacity overage feature, currently in preview, bills excess compute at a multiple of the pay-as-you-go rate rather than throttling. Contractors must decide, per capacity, whether overage is on or off and what the cap is, and name the owner who reviews the Capacity Metrics app.

Treat agents as principals is another essential guideline. Microsoft has previewed data engineering agents and operations agents that run from lists of pre-approved actions. In a CMMC-scoped environment, an agent is a non-human identity with an approved-actions list, an owner, a workspace scope, and a log. Contractors must write the list before the agent exists.

The right first workload is the one already producing a finding or a manual hand-off. This could be a Power BI estate refreshing from file shares or the consolidation of configuration, access-review, and incident evidence into one governed reporting layer for the assessment itself.

Planning the exit from the commercial cloud deliberately is another critical step. Contractors with Power BI Premium or Fabric in the commercial tenant should document what moves, what is retired, and what stays, with dates, so the boundary diagram an assessor reviews matches reality on the day it is requested, whichever day that turns out to be.

EPC Group's openly published 8-Surface Tenant AI Readiness Standard, TAR-8, was written for exactly this ordering problem. It scores the eight surfaces of a Microsoft 365 and Azure tenant that any AI or analytics deployment depends on, identity, information protection, oversharing, agent identity, external-model access, cost governance, and the rest, and its gating rules require the underlying surface to be controlled before the workload that depends on it is switched on.

For a GCC High tenant, the eight surfaces map directly onto the five assessor question families. Access control, audit and accountability, configuration management, identification and authentication, and system and information integrity are the key areas that will be assessed. A contractor that can answer those five families with documents rather than demonstrations holds the analytics estate as an asset in the assessment rather than an exception to it.

EPC Group's own records show that the firm has 1,500-plus Power BI deployments and 500-plus Microsoft Fabric implementations since 1997, within 11,000-plus enterprise engagements. This experience underscores the firm's commitment to helping contractors navigate the complexities of compliance and analytics in the GCC High environment.

In summary, the suspension of CMMC Phase 2 provides a unique opportunity for contractors to strategically plan their compliance efforts. EPC Group's GCC High Data-Foundation Checklist and the 8-Surface Tenant AI Readiness Standard, TAR-8, offer a comprehensive guide to ensure that contractors can meet the same 110 NIST SP 800-171 requirements later, with less time.