https://techcommunity.microsoft.com/t5/public-sector-blog/understanding-compliance-between-commercial-government-and-dod/ba-p/3258326?lightbox-message-images-3258326=508818i24BE6A628F866A5B


try to get to level 1 -- stop upload docs.. use azure for sso

azure is fedramp moderate ato

what is prohibiting me from getting dropped to a lower level

how are they justifying the impact?

we don't have any access to the VA system -- it is a stand alone-- there is no impact to the va operation

for va -- remove email addresses

gap assessment for x number of controls-- 

what pushes me into moderate category? 

azure ad gives us MFA