I work for a very small (~50 people) company as the sole IT provider. I have been working angles for NIST compliance over the last year. Currently we are only deficient in a few areas that I am trying to tackle at the moment. Our setup is almost entirely on-premises (besides e-mail), I have about 15 users who use desktops for day to day activity and 8 that have the potential to handle CUI.

Two of the requirements that I have been working on are MFA for local access to our desktops and encryption for CUI in transit. We currently are using a dated email setup with multiple users utilizing a single email and inbox, and we have a few GoDaddy M365 Emails that are utilized as well. I attempted to utilize the GoDaddy emails with Entra ID to allow Windows Hello for Business to cover our MFA requirement but GoDaddy's M365 plans are pretty useless from what I have discovered and do not work with Windows Hello for Business among other things. So I was planning to defederate my domain and purchase licensing directly from Microsoft. It appears that M365 Business Standard is sufficient for all of our needs with added email encryption options available to the 8 users who would need to transmit CUI.

I'm trying to grapple if this will be a better setup than just utilizing say something like Cisco DUO for MFA and purchasing S/MIME certs or GoDaddy's Advanced Email Security add-on for the users that need to transmit CUI. We would not be utilizing most of the cloud storage capabilities as we store our data on site. Any input is helpful, been going back and forth with this for a few days now.

Other solutions are also welcome. Other things I have considered are utilizing Box and essentially storing all of our CUI there and using Box's upload and sharing features to transmit CUI. I have considered opting to go straight to M365 GCC High and migrating all of our data there which does contain ITAR data (ITAR data is intended only for users within the company and will not need to be transmitted) which will be the most inclusive solution but also extremely pricey.