Fabric went GA in GCC High on Oct 1, 2026; the Department of War suspended the CMMC Phase 2 transition in July. Nine checks to run before moving analytics.
HOUSTON, TX, UNITED STATES, October 2, 2026 /EINPresswire.com/ — EPC Group, a Houston-based Microsoft consulting firm founded in 1997, today published a nine-point data-foundation checklist for defense contractors weighing Microsoft Fabric in GCC High. Microsoft made Fabric generally available in its GCC High government cloud on October 1, 2026.
The Department of War suspended the November 2026 transition to Phase 2 of the Cybersecurity Maturity Model Certification program on July 13, 2026, and has not restored a start date. EPC Group’s guidance: the suspension is not a reprieve from NIST SP 800-171 — it is a planning window in which a contractor can put its analytics estate inside the compliance boundary deliberately rather than against a deadline, and the nine questions below should have written answers before the first Fabric capacity is provisioned.
WHAT DID MICROSOFT MAKE AVAILABLE TODAY?
In a September 2, 2026 post on the Microsoft US Government blog, Microsoft announced Microsoft Fabric in GCC High with public preview beginning that day and general availability on October 1, 2026. Microsoft was explicit about scope: “feature availability at public preview and general availability will vary by workload and expand over time,” and “not all Microsoft Fabric capabilities will be available at launch,” directing readers to the Microsoft Learn supported-features list for what is included.
Douglas Phillips, President and Chief Technology Officer of Microsoft Specialized Clouds, framed the release plainly: “The future of AI starts with data. With Microsoft Fabric in GCC High, government organizations can begin building that foundation today.”
Source for the Microsoft quotations above: https://www.microsoft.com/en-us/microsoft-cloud/blog/us-government/2026/09/02/microsoft-fabric-in-gcc-high-building-the-data-foundation-for-ai/
GCC High is the Microsoft 365 and Azure Government environment Microsoft positions for U.S. defense contractors and agencies that handle Controlled Unclassified Information and export-controlled data. Fabric brings OneLake, lakehouse and warehouse workloads, Real-Time Intelligence, data pipelines and Power BI under one platform and one capacity model there, subject to the workload-by-workload availability Microsoft described.
The same week, at FabCon Europe in Barcelona, Microsoft’s Arun Ulag wrote that “Fabric IQ in Copilot Chat and Cowork is generally available today” and that on-demand billing “expands consumption-based billing across Fabric workloads,” “automatically scaling resources up and down based on your demand.” Which of those commercial-cloud capabilities reach GCC High, and when, is the question every contractor should ask before designing around them — and each arrives with a governance decision attached: which semantic models are labeled before Copilot answers from them, which actions an agent may take, and who reviews the meter.
Source for the Arun Ulag quotations: https://azure.microsoft.com/en-us/blog/fabcon-and-sqlcon-2026-in-barcelona-building-the-data-foundation-for-microsoft-copilot-and-agents/
WHERE DOES CMMC ACTUALLY STAND?
The CMMC acquisition rule, DFARS 252.204-7021, took effect on November 10, 2025 and phased the requirement into contracts over three years. Phase 2 — the point at which Level 2 third-party certification by a CMMC Third-Party Assessment Organization could appear as a condition of award — was scheduled for November 10, 2026.
That transition is suspended. In a memorandum dated July 13, 2026, the Under Secretary of War for Acquisition and Sustainment directed that pending and future CMMC implementation milestones be paused while a CMMC Reform Task Force reviews the program. The Department’s implementing procedures state: “during this suspension the Department will enforce baseline compliance with NIST SP 800-171 Rev 2 through CMMC Level 1 and CMMC Level 2 self-assessment and select Government-led assessments.”
Source for the suspension and the quotation above: https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf
A September 3, 2026 class deviation — DFARS Class Deviation 2026-O0025, Revision 3, issued by the Department’s Defense Pricing, Contracting, and Acquisition Policy office — made the suspension binding on contracting officers. As of today, the Department has not restored a Phase 2 start date.
What did not change is the part most contractors underestimate. DFARS 252.204-7012 still requires covered defense information to be safeguarded. NIST SP 800-171 Revision 2 remains the assessed baseline. Self-assessment scores still have to be posted to the Supplier Performance Risk System, and the CMMC program rule at 32 CFR Part 170 remains in force. A contractor that treats the pause as permission to stop building evidence will meet the same 110 requirements later, with less time.
Sources: DFARS 252.204-7012 https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.204-7012 — NIST SP 800-171 Rev. 2 https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final — 32 CFR Part 170 https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-170
“Every defense contractor we have spoken with this quarter had a plan built around November 10, and the plan was a sprint,” said Errin O’Connor, Founder and Chief AI Architect of EPC Group. “The suspension turns the sprint into a window. Fabric arriving in GCC High is the opportunity: for the first time, ‘where does the evidence live’ can be answered with a governed analytics layer inside the boundary instead of a spreadsheet outside it. But an assessor — your own senior official affirming a self-assessment, or a C3PAO later — does not care how modern the platform is. It cares whether it is in scope, labeled, logged and owned.”
THE NINE-POINT CHECKLIST
EPC Group’s checklist is written for the contractor who intends to move Power BI reporting, security telemetry analytics or program data into Fabric in GCC High during the pause. Each point should have a written answer before the first capacity is provisioned.
Confirm the workload is actually available in GCC High today. Microsoft states availability varies by workload at general availability and expands over time. Check the Microsoft Learn supported-features list at https://learn.microsoft.com/en-us/fabric/enterprise/us-government-community-cloud-high for the specific items — lakehouse, warehouse, Real-Time Intelligence, data pipelines, mirroring, Copilot and Fabric IQ — the design depends on. A design that needs a preview feature is a design that waits.
Decide whether the Fabric workspace is inside the assessment scope. If Controlled Unclassified Information will land in OneLake, the workspace, its capacity and its administrators are in scope for the Level 2 assessment — self-assessed today, third-party-assessed whenever the Department says so. Document that decision and the data-flow diagram now, while nobody is asking for it.
Map identity before data. Fabric inherits Microsoft Entra identity in GCC High. Confirm that conditional access, privileged identity management and the access-review cadence already required under NIST SP 800-171 extend to Fabric workspace roles, capacity admins and OneLake shortcuts. A shortcut to an external source is an access path an assessor will trace.
Apply Microsoft Purview sensitivity labels to the semantic models and lakehouses that will hold CUI, and confirm that the Purview controls Fabric already supports in the commercial cloud — sensitivity-label inheritance, and data-loss-prevention policies with the restrict-access action on semantic models and lakehouses — are available in GCC High before relying on them.
Route Fabric and OneLake audit events into the logging and monitoring evidence trail. NIST SP 800-171 audit and accountability requirements do not exempt a new platform. Decide where Fabric activity logs land, how long they are retained and who reviews them, and record it in the System Security Plan.
Set the capacity posture in writing. Microsoft’s capacity overage feature, in preview, bills excess compute at a multiple of the pay-as-you-go rate rather than throttling, opt-in per capacity with an administrator-set daily limit. Decide, per capacity, whether overage is on or off and what the cap is, and name the owner who reviews the Capacity Metrics app.
Treat agents as principals. Microsoft has previewed a data engineering agent and operations agents that run from lists of pre-approved actions. In a CMMC-scoped environment, an agent is a non-human identity with an approved-actions list, an owner, a workspace scope and a log. Write the list before the agent exists.
Sequence the first workload by evidence value, not by ambition. The right first workload is the one already producing a finding or a manual hand-off: a Power BI estate refreshing from file shares, or the consolidation of configuration, access-review and incident evidence into one governed reporting layer for the assessment itself.
Plan the exit from the commercial cloud deliberately. Contractors with Power BI Premium or Fabric in the commercial tenant should document what moves, what is retired and what stays — with dates — so the boundary diagram an assessor reviews matches reality on the day it is requested, whichever day that turns out to be.
WHAT AN ASSESSOR WILL ASK ABOUT AN ANALYTICS PLATFORM
An assessor evaluating a Level 2 environment does not assess Fabric as a product; it assesses the organization’s implementation of the 110 NIST SP 800-171 requirements across the systems in scope. For an analytics platform the questions cluster in five families. Access control: who holds workspace, capacity and tenant-level roles, how they are reviewed, and whether shortcuts or mirrored sources create paths to external data. Audit and accountability: which events the platform logs, where they are retained, how long, and who reviews them.
Configuration management: how workspaces, capacities and connections are provisioned, documented and change-approved. Identification and authentication: whether every human and non-human identity — including agents — authenticates through the tenant’s identity provider under the same conditional-access rules as the rest of the environment. And system and information integrity: how sensitivity labels, data-loss-prevention policies and information-protection controls apply to the data the platform stores and to the AI experiences that read it.
A contractor that can answer those five families with documents rather than demonstrations holds the analytics estate as an asset in the assessment rather than an exception to it.
EPC Group’s openly published 8-Surface Tenant AI Readiness Standard, TAR-8, was written for exactly this ordering problem. It scores the eight surfaces of a Microsoft 365 and Azure tenant that any AI or analytics deployment depends on — identity, information protection, oversharing, agent identity, external-model access, cost governance and the rest — and its gating rules require the underlying surface to be controlled before the workload that depends on it is switched on.
For a GCC High tenant the eight surfaces map directly onto the five assessor question families above, which is why the firm recommends running the TAR-8 score before the first Fabric capacity is provisioned.
The standard is public at https://www.epcgroup.net/insights/microsoft-365-tenant-ai-readiness-8-surface-standard and the firm delivers it as a fixed-scope readiness assessment: https://www.epcgroup.net/services/microsoft-365-copilot-readiness-assessment
THE NINETY-DAY WINDOW, OCTOBER 1 TO DECEMBER 31
Because the Department has not published a replacement schedule, EPC Group suggests the contractor set its own: the calendar quarter in which Fabric became available, ending before most Power BI Premium renewals come due. Days one through fifteen: read Microsoft’s supported-features list against the intended design, decide the assessment-scope question in writing, and inventory the commercial-tenant analytics estate that will move, retire or stay.
Days sixteen through forty-five: extend conditional access, privileged identity management and access reviews to Fabric roles; apply sensitivity labels to the semantic models and lakehouses that will hold CUI; route Fabric audit events into the existing evidence trail and record the retention decision in the System Security Plan. Days forty-six through seventy-five: provision the first capacity with a written overage posture and a named owner, migrate the first workload — the one already producing a finding — and document the data-flow diagram.
Days seventy-six through ninety: run an internal evidence review against the five question families, correct gaps, freeze the boundary diagram, and refresh the SPRS self-assessment score so the environment on record matches the one that was built.
The seven decisions a Fabric buyer should settle before a capacity renewal — including the GCC High-specific ones — are set out in EPC Group’s companion analysis published today.
WHAT EPC GROUP’S RECORD IN THIS SPACE ACTUALLY IS
EPC Group separates third-party facts from company-reported figures, and applies that rule to itself. The firm holds all six Microsoft Solutions Partner designations, verifiable through Microsoft’s partner directory. It has been named a G2 Leader in Business Intelligence Consulting for seven consecutive quarterly reports through Fall 2026 and received a Fall 2026 Momentum Leader badge — designations G2 calculates from verified client reviews and market-presence data. Source: https://www.g2.com/products/epc-group/reviews
Company-reported, from EPC Group’s own records: 1,500-plus Power BI deployments and 500-plus Microsoft Fabric implementations since 1997, within 11,000-plus enterprise engagements. The subset of engagements documented with claim levels and hashed source files — including federal, defense and public-sector records for NASA Johnson Space Center, the National Institutes of Health, the Federal Reserve Bank of New York, Northrop Grumman and Texas state agencies — is published, with a methodology page explaining what each record does and does not establish, in the firm’s Evidence Center: https://www.epcgroup.net/evidence-center
Defense contractors and agencies that want the nine points applied to their own tenant can request a GCC High, Fabric and CMMC scoping call at https://www.epcgroup.net/contact/gcc-high-cmmc — the firm’s federal practice is described at https://www.epcgroup.net/industries/federal-government
QUESTIONS DEFENSE CONTRACTORS ARE ASKING
Is Microsoft Fabric generally available in GCC High today?
Yes — Microsoft’s US Government blog states general availability on October 1, 2026, following public preview from September 2, 2026, with feature availability varying by workload and expanding over time.
Is CMMC Phase 2 still starting in November 2026?
No. The Department of War suspended the November 2026 transition on July 13, 2026; a September 3, 2026 class deviation made the suspension binding on contracting officers. During the suspension, NIST SP 800-171 Rev 2 compliance is enforced through Level 1 and Level 2 self-assessments and select Government-led assessments. No replacement start date has been published.
Does the suspension change what we must do under NIST SP 800-171?
No. DFARS 252.204-7012, the NIST SP 800-171 Revision 2 baseline, SPRS self-assessment posting and 32 CFR Part 170 all remain in effect. The suspension changes when a third-party certification could be required, not whether the 110 requirements apply.
Does adopting Fabric in GCC High change our assessment scope?
If CUI is stored or processed in OneLake, the Fabric workspace, capacity and administrators are within the Level 2 assessment boundary. Document the decision and the data-flow diagram in advance.
Do the FabCon Europe announcements apply to GCC High?
Microsoft announced them for Fabric broadly and stated GCC High feature availability varies by workload; confirm each feature on the Microsoft Learn supported-features list before designing around it.
About EPC Group
EPC Group is a Houston-based Microsoft consulting firm founded March 30, 1997, and now in its 30th year. The firm provides Power BI, Microsoft Fabric, Microsoft 365, SharePoint, Azure, Microsoft Purview, Power Platform, Copilot and AI governance services — including its Virtual Chief AI Officer practice — and holds all six Microsoft Solutions Partner designations. Founder and Chief AI Architect Errin O’Connor is the author of four books on SharePoint and Power BI (Microsoft Press; Sams/Pearson).
EPC Group at epcgroup.net is unrelated to the German engineering firm EPC Group at epc.com and the French explosives company EPC Groupe.
Learn more by emailing us at contact@epcgroup.net, give us a call at 888-381-9725 or visit us on the web at https://www.epcgroup.net
Michelle Stevens
EPC Group
+ +1 888-381-9725
email us here
Visit us on social media:
LinkedIn
Bluesky
Instagram
Facebook
YouTube
TikTok
X
Other
Why Clients Trust EPC Group: 7 Quarters of G2 Leader Recognition
Legal Disclaimer:
EIN Presswire provides this news content “as is” without warranty of any kind. We do not accept any responsibility or liability
for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this
article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
Media gallery
