EPC Group Publishes a GCC High Data-Foundation Checklist as Microsoft Fabric Goes GA During the CMMC Phase 2 Pause

HOUSTON, October 1, 2026 — EPC Group, a Houston-based Microsoft consulting firm founded in 1997, today published a nine-point data-foundation checklist for defense contractors weighing Microsoft Fabric in GCC High. Microsoft made Fabric generally available in its GCC High government cloud on October 1, 2026. The Department of War suspended the November 2026 transition to Phase 2 of the Cybersecurity Maturity Model Certification program on July 13, 2026, and has not restored a start date. EPC Group's guidance: the suspension is not a reprieve from NIST SP 800-171 — it is a planning window in which a contractor can put its analytics estate inside the compliance boundary deliberately rather than against a deadline, and the nine questions below should have written answers before the first Fabric capacity is provisioned.

What did Microsoft make available today?

In a September 2, 2026 post on the Microsoft US Government blog, Microsoft announced Microsoft Fabric in GCC High with public preview beginning that day and general availability on October 1, 2026. Microsoft was explicit about scope: “feature availability at public preview and general availability will vary by workload and expand over time,” and “not all Microsoft Fabric capabilities will be available at launch,” directing readers to the Microsoft Learn supported-features list for what is included. Douglas Phillips of Microsoft framed the release plainly: “The future of AI starts with data. With Microsoft Fabric in GCC High, government organizations can begin building that foundation today.”

GCC High is the Microsoft 365 and Azure Government environment Microsoft positions for U.S. defense contractors and agencies that handle Controlled Unclassified Information and export-controlled data. Fabric brings OneLake, lakehouse and warehouse workloads, Real-Time Intelligence, data pipelines and Power BI under one platform and one capacity model there, subject to the workload-by-workload availability Microsoft described.

The same week, at FabCon Europe in Barcelona, Microsoft's Arun Ulag wrote that “Fabric IQ in Copilot Chat and Cowork is generally available today” and that on-demand billing “expands consumption-based billing across Fabric workloads,” “automatically scaling resources up and down based on your demand.” Which of those commercial-cloud capabilities reach GCC High, and when, is the question every contractor should ask before designing around them.

Where does CMMC actually stand?

The CMMC acquisition rule, DFARS 252.204-7021, took effect on November 10, 2025 and phased the requirement into contracts over three years. Phase 2 — the point at which Level 2 third-party certification by a CMMC Third-Party Assessment Organization could appear as a condition of award — was scheduled for November 10, 2026. That transition is suspended.

In a memorandum dated July 13, 2026, the Under Secretary of War for Acquisition and Sustainment directed that pending and future CMMC implementation milestones be paused, that only Level 1 and Level 2 self-assessment requirements may be required while the program is reviewed, and that a CMMC Reform Task Force conduct a review of the program. A September 3, 2026 class deviation issued by the Department's Defense Pricing, Contracting, and Acquisition Policy office made the suspension binding on contracting officers. As of today, the Department has not restored a Phase 2 start date.

What did not change is the part most contractors underestimate. DFARS 252.204-7012 still requires covered defense information to be safeguarded. NIST SP 800-171 Revision 2 remains the assessed baseline. Self-assessment scores still have to be posted to the Supplier Performance Risk System, and the CMMC program rule at 32 CFR Part 170 remains in force. A contractor that treats the pause as permission to stop building evidence will meet the same 110 requirements later, with less time.

“Every defense contractor we have spoken with this quarter had a plan built around November 10, and the plan was a sprint,” said Errin O'Connor, Founder and Chief AI Architect of EPC Group. “The suspension turns the sprint into a window. Fabric arriving in GCC High is the opportunity: for the first time, ‘where does the evidence live’ can be answered with a governed analytics layer inside the boundary instead of a spreadsheet outside it. But an assessor — your own senior official affirming a self-assessment, or a C3PAO later — does not care how modern the platform is. It cares whether it is in scope, labeled, logged and owned.”

The nine-point checklist

EPC Group's checklist is written for the contractor who intends to move Power BI reporting, security telemetry analytics or program data into Fabric in GCC High during the pause. Each point is a question that should have a written answer before the first capacity is provisioned.

1. Confirm the workload is actually available in GCC High today. Microsoft states availability varies by workload at general availability and expands over time. Check the Microsoft Learn supported-features list for the specific items — lakehouse, warehouse, Real-Time Intelligence, data pipelines, mirroring, Copilot and Fabric IQ — the design depends on. A design that needs a preview feature is a design that waits.
2. Decide whether the Fabric workspace is inside the assessment scope. If Controlled Unclassified Information will land in OneLake, the workspace, its capacity and its administrators are in scope for the Level 2 assessment — self-assessed today, third-party-assessed whenever the Department says so. Document that decision and the data-flow diagram now, while nobody is asking for it.
3. Map identity before data. Fabric inherits Microsoft Entra identity in GCC High. Confirm that conditional access, privileged identity management and the access-review cadence already required under NIST SP 800-171 extend to Fabric workspace roles, capacity admins and OneLake shortcuts. A shortcut to an external source is an access path an assessor will trace.
4. Apply Microsoft Purview sensitivity labels to the semantic models and lakehouses that will hold CUI, and confirm that the Purview controls Fabric already supports in the commercial cloud — sensitivity-label inheritance, and data-loss-prevention policies with the restrict-access action on semantic models and lakehouses — are available in GCC High before relying on them.
5. Route Fabric and OneLake audit events into the logging and monitoring evidence trail. NIST SP 800-171 audit and accountability requirements do not exempt a new platform. Decide where Fabric activity logs land, how long they are retained and who reviews them, and record it in the System Security Plan.
6. Set the capacity posture in writing. Microsoft's capacity overage feature, in preview, bills excess compute at a multiple of the pay-as-you-go rate rather than throttling, opt-in per capacity with an administrator-set daily limit. Decide, per capacity, whether overage is on or off and what the cap is, and name the owner who reviews the Capacity Metrics app.
7. Treat agents as principals. Microsoft previewed a data engineering agent and an operations agent with "pre-approved actions." In a CMMC-scoped environment, an agent is a non-human identity with an approved-actions list, an owner, a workspace scope and a log. Write the list before the agent exists.
8. Sequence the first workload by evidence value, not by ambition. The right first workload is the one already producing a finding or a manual hand-off: a Power BI estate refreshing from file shares, or the consolidation of configuration, access-review and incident evidence into one governed reporting layer for the assessment itself.
9. Plan the exit from the commercial cloud deliberately. Contractors with Power BI Premium or Fabric in the commercial tenant should document what moves, what is retired and what stays — with dates — so the boundary diagram an assessor reviews matches reality on the day it is requested, whichever day that turns out to be.

What the Barcelona announcements mean for a GCC High planner

The FabCon Europe announcements describe where the platform is going, not what a contractor can deploy inside the boundary today. Each will matter in GCC High when Microsoft's supported-features list says it does — and each arrives with a governance decision attached: which semantic models are certified and labeled before Copilot answers from them, which actions an agent may take and who approved them, and which owner reviews the meter. EPC Group's recommendation is to make those three decisions now, on the workloads available today, so the commercial-cloud capabilities land in a governed estate when they reach GCC High.

What an assessor will ask about an analytics platform

An assessor evaluating a Level 2 environment does not assess Fabric as a product; it assesses the organization's implementation of the 110 NIST SP 800-171 requirements across the systems in scope — as true of the senior-official affirmation behind a self-assessment as of a third-party assessment. For an analytics platform the questions cluster in five families. Access control: who holds workspace, capacity and tenant-level roles, how they are reviewed, and whether shortcuts or mirrored sources create paths to external data. Audit and accountability: which events the platform logs, where they are retained, how long, and who reviews them. Configuration management: how workspaces, capacities and connections are provisioned, documented and change-approved. Identification and authentication: whether every human and non-human identity — including agents — authenticates through the tenant's identity provider under the same conditional-access rules as the rest of the environment. And system and information integrity: how sensitivity labels, data-loss-prevention policies and information-protection controls apply to the data the platform stores and to the AI experiences that read it. A contractor that can answer those five families with documents rather than demonstrations holds the analytics estate as an asset in the assessment rather than an exception to it.

EPC Group's openly published 8-Surface Tenant AI Readiness Standard, TAR-8, was written for exactly this ordering problem. It scores the eight surfaces of a Microsoft 365 and Azure tenant that any AI or analytics deployment depends on — identity, information protection, oversharing, agent identity, external-model access, cost governance and the rest — and its gating rules require the underlying surface to be controlled before the workload that depends on it is switched on. For a GCC High tenant the eight surfaces map directly onto the five assessor question families above, which is why the firm recommends running the TAR-8 score before the first Fabric capacity is provisioned. The firm delivers it as a fixed-scope readiness assessment.

The ninety-day window, October 1 to December 31

Because the Department has not published a replacement schedule, EPC Group suggests the contractor set its own: the calendar quarter in which Fabric became available, ending before the renewal and budget season in which most Power BI Premium commitments come due. Days one through fifteen: read Microsoft's supported-features list against the intended design, decide the assessment-scope question in writing, and inventory the commercial-tenant analytics estate that will move, retire or stay. Days sixteen through forty-five: extend conditional access, privileged identity management and access reviews to Fabric roles; apply sensitivity labels to the semantic models and lakehouses that will hold CUI; route Fabric audit events into the existing evidence trail and record the retention decision in the System Security Plan. Days forty-six through seventy-five: provision the first capacity with a written overage posture and a named owner, migrate the first workload — the one already producing a finding — and document the data-flow diagram. Days seventy-six through ninety: run an internal evidence review against the five question families, correct gaps, freeze the boundary diagram, and refresh the SPRS self-assessment score so the environment on record matches the one that was built. The seven decisions a Fabric buyer should settle before a capacity renewal — including the GCC High-specific ones — are set out in EPC Group's companion analysis published today.

What EPC Group's record in this space actually is

EPC Group separates third-party facts from company-reported figures, and applies that rule to itself. The firm holds all six Microsoft Solutions Partner designations, verifiable through Microsoft's partner directory. It has been named a G2 Leader in Business Intelligence Consulting for 7 consecutive quarterly reports through Fall 2026 and received a Fall 2026 Momentum Leader badge — designations G2 calculates from verified client reviews and market-presence data.

Company-reported, from EPC Group's own records: 1,500+ Power BI deployments and 500+ Microsoft Fabric implementations since 1997, within 11,000+ enterprise engagements. The subset of engagements documented with claim levels and hashed source files — including federal, defense and public-sector records for NASA Johnson Space Center, the National Institutes of Health, the Federal Reserve Bank of New York, Northrop Grumman and Texas state agencies — is published, with a methodology page explaining what each record does and does not establish, in the firm's Evidence Center.

Defense contractors and agencies that want the nine points applied to their own tenant can request a GCC High, Fabric and CMMC scoping call — the firm's federal practice is described at EPC Group for federal government.

Questions defense contractors are asking

About EPC Group

EPC Group (O'Connor Enterprise Group Inc.) is a Houston-based Microsoft consulting firm founded March 30, 1997, and now in its 30th year. The firm provides Power BI, Microsoft Fabric, Microsoft 365, SharePoint, Azure, Microsoft Purview, Power Platform, Copilot and AI governance services — including its Virtual Chief AI Officer practice — and holds all six Microsoft Solutions Partner designations. Founder and Chief AI Architect Errin O'Connor is the author of four books on SharePoint and Power BI (Microsoft Press; Sams/Pearson). EPC Group at epcgroup.net is unrelated to the German engineering firm EPC Group at epc.com and the French explosives company EPC Groupe.

Media contact: Michelle Stevens, EPC Group · +1 888-381-9725 · epcgroup.net/contact