# Defense Contractors Audit CUI Access Before Copilot

Guidance for defense contractors says Microsoft 365 Copilot in GCC High can surface Controlled Unclassified Information (CUI) that a user is already permitted to access; the cloud environment does not automatically fix overly broad file permissions. Contractors are advised to review tenant-level access, sensitivity labels, encryption, and contract-specific security obligations before assigning Copilot licenses. The signals also report that CMMC Phase II requirements, originally scheduled for November 10, 2026, were suspended pending review on July 13, 2026. Contractors must continue meeting CMMC terms in existing solicitations and contracts and check applicable guidance and amendments.

- Before deploying Copilot, organizations should audit who can access CUI and confirm that GCC High settings, labels, and encryption reflect their contract obligations.
- The reported Phase II suspension changes the status of the scheduled implementation, but does not remove CMMC requirements already included in solicitations or contracts.
- Procurement and security teams should coordinate license assignments with contract reviews so that new AI access does not expose information beyond authorized users.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Artificial Intelligence, Regulatory Compliance
**Published:** October 27, 2026

### Government Entities
- U.S. Department of War (DoW)

### Vendors
- Microsoft (Provider of Microsoft 365 Copilot and GCC High)
- eSoftware Associates (ESW) (Microsoft 365 migration and consulting services provider)

### Sources
- [Defense contractors must review CUI access befo... | Pluang](https://pluang.com/en/news-feed/kontraktor-pertahanan-copilot-gcc-high-gunakan-izin-cui-ada) - Pluang
- [ For Defense Contractors, Copilot in GCC High Uses Existing CUI Permissions

 | The Manila Times ](https://www.manilatimes.net/2026/10/27/tmt-newswire/globenewswire/for-defense-contractors-copilot-in-gcc-high-uses-existing-cui-permissions/2454826) - The Manila Times
- [For Defense Contractors, Copilot in GCC High Uses Existing CUI Permissions

](https://www.manilatimes.net/2026/10/27/tmt-newswire/globenewswire/for-defense-contractors-copilot-in-gcc-high-uses-existing-cui-permissions/2454826/amp) - The Manila Times