Does CMMC Level 2 require a government cloud tenant, or can I stay on my commercial email and file sharing?

CMMC Level 2 does not automatically require a government cloud tenant; it depends on the type of data you handle and whether your commercial productivity suite can meet the security requirements for that data.

CMMC Level 2 requires the 110 requirements of NIST SP 800-171 Revision 2. Whether your commercial email and file sharing can be configured to meet these controls is the key. You need to understand what type of federal contract information (FCI) or controlled unclassified information (CUI) you will be processing, storing, or transmitting. If the data is CUI, then the requirements are stricter and often necessitate specific cloud environments that are authorized to handle CUI.

My shop sticks to county and school district work because federal compliance gets complicated and expensive fast. We don't have to deal with CMMC for those contracts. Many small businesses our size find that the cost of compliance, whether it's specialized cloud services or in-house IT upgrades, can be significant. Talk to your APEX Accelerator about the specific data types outlined in the solicitation and what controls your current commercial suite can actually deliver.