To paint a better picture I have a platform hosted in a GovCloud but there are plugins that have been added to the platform that are developed outside the US, pull their updates from non-US servers and would have support services from non-US persons.

I’d really like to see if anyone else has navigated this when inheriting a similar system. Or to see if a CMMC SME can help provide clarity on how this impacts compliance and certification.

Thank you.