Scenario – A U.S. subsidiary of a foreign company wants to move into Department of Defense work subject to DFARS 7012. There is a local IT team with the ability to manage users on a local domain controller, rebuild PCs with Intune but that is about it. The on-premises domain controller syncs with the global Entra ID.

The local team does not handle any networking, server management, or domain administration. They function as IT Field Services and all network, server, domain administration is handled by non-US persons based in Europe and India.

What guidance would you give this company? They are subject to ITAR/EAR and a prime contractor is recommending a L2 CMMC Certification.

The only option I see is to separate the US location from the global company.