System Admin here, started at a new company about 6 months ago for a decently sized Federal Subcontractor. (100 - 120 users).

I need some advice on what to do about our Data Storage Solution and get some input from you all:

• In total, we have roughly 2TB of hot data. We are currently utilizing SharePoint Online to store it all - but right now its a hot mess... Permissions are totally out of wack, users are having consistent issues because they are exceeding the 400 character limit so files and folders are randomly getting lost, or they are duplicating themselves, and getting a bunch of one off errors.
• We have roughly 10TB of cold data - that is mainly kept for long term retention (must keep for 6 years) for users who leave the company like terminations and what not. Currently utilizing an old NAS to store all of it (Personal OneDrive and mailboxes). When a C Suite requests access to this data - its a painstaking process of having to reupload it all to sharepoint, download the users PST and add it to their mailbox. Security wise - its a nightmare....
• Being a Federal Subcontractor and working with the DoD, we must achieve CMMC level 2 compliance sometime in 2025 since we handle CUI Data. 80% of the company handles CUI and that is what mostly our data consists of. I started looking at enclave solutions like PreVail and Box - but I am skeptical about moving all of our data over to a solution like that... I did find a couple of solutions that integrate with our 365 tenant and use MIcrosoft's native Data Storage solutions like Azure Blob, Azure Files, and Sharepoint such as XQ.

I am basically trying to tackle multiple things at once in terms of how we are handling data. Should we continue to use SharePoint for Hot Data and just fix what we have or do I consider moving hot data to Azure Files and practically redo the whole Folder Structure and fix all the file permissions? Do I utilize Azure Blob to store all of our cold data? Then at the end of it - get a CUI handling solution that integrates with our tenant? Does anyone have any experience utilizing XQ for handling CUI?