Locations / Cedar Park, Texas
Microsoft 365 consulting for Cedar Park organisations.
Cedar Park sits on 183A rather than I-35, and it has spent the last decade building something other than a commuter base: a launch company headquarters, a defence innovation campus, a spaceport development corporation formed in 2025, and medical technology manufacturing. That mix carries the hardest compliance obligations in the Austin metro. Identra configures Entra, Defender XDR and Purview for organisations that handle controlled information and have to prove it.
- Service area
- Cedar Park, Leander, Liberty Hill, north-west Williamson County
- Delivery mode
- Remote-first, on-site available
- License footprint
- M365 E3 or E5, GCC High where CUI requires it
- Delivery
- Fixed scope, fixed price
01 / What we configure
Four practice areas for Cedar Park buyers.
- 01
CMMC Level 2 and CUI in Microsoft 365
The DFARS rule implementing CMMC took effect on 10 November 2025, and requirements now appear in solicitations on a phased rollout. Level 2 is the 110 controls of NIST SP 800-171 for organisations that process, store or transmit controlled unclassified information. The practical question for a supplier is which tenant that information may live in. Identra scopes CUI, advises on the commercial versus GCC High decision, and configures the controls that carry evidence.
CMMC Level 2NIST 800-171GCC High - 02
Export control and ITAR-restricted work
Launch and aerospace employers in Cedar Park run US person restrictions on technical data. In a Microsoft 365 tenant that becomes a question about who can open a file, where the data is stored, and whether a guest account or a support engineer could reach it. Identra configures conditional access, information barriers and sensitivity labelling so the restriction is enforced by the platform rather than by an instruction.
Export controlInformation barriersUS person - 03
Life sciences and medical technology
Medical technology manufacturing has moved into Cedar Park, and Ascension Seton Cedar Park changed to full Ascension ownership in mid-2025, which puts systems integration work in front of clinical and vendor teams. Identra configures HIPAA-aligned access control, PHI data loss prevention, and the Texas HB 300 additions on training records and record delivery timelines.
HIPAAHB 300Medical device IP - 04
City and school district (HB 3834)
The City of Cedar Park and Leander ISD both fall under Texas Government Code 2054.5191, which requires annual DIR-certified cybersecurity training for staff and elected officials who use a computer for a quarter or more of their duties, certified by 31 August each year. Identra makes the in-scope population definable from Entra rather than assembled by hand.
HB 3834Annual certificationLocal government
02 / What it looks like
Three Cedar Park engagements.
A defence corridor, a hospital under new ownership, and a school district. Different asks, one tenant each.
Operations director at an aerospace supplier
Situation. Prime contractor flowed down CMMC Level 2 in a new solicitation. Engineering drawings sit in SharePoint on a commercial tenant alongside everything else. Nobody has scoped what is actually CUI.
Outcome. CUI scoped and separated rather than the whole tenant being uplifted. Sensitivity labels and data loss prevention applied to the scoped set. A documented control mapping to NIST SP 800-171 that survives an assessor asking how it is enforced.
IT lead at a Cedar Park manufacturer with export-controlled work
Situation. Technical data is restricted to US persons. Enforcement is a shared understanding among a small team, plus folder permissions nobody has audited in two years.
Outcome. Conditional access conditions on the restricted workload. Information barriers between groups. External sharing disabled on the labelled content, with an access review cadence that produces its own record.
Compliance manager at a medical technology firm
Situation. New facility, growing headcount, and a health system customer asking for evidence of PHI handling before signing a Business Associate Agreement.
Outcome. PHI data loss prevention and retention configured. Access reviews scheduled. The customer questionnaire answered from tenant configuration, and the HB 300 training and record-delivery obligations documented alongside the HIPAA ones.
03 / Frequently asked
What buyers ask first.
- Does CMMC apply to us if we are a small supplier?
- Size is not the test. What matters is whether you process, store or transmit controlled unclassified information under a defence contract, including as a subcontractor. The DFARS rule took effect on 10 November 2025 and requirements are appearing in solicitations on a phased rollout. Level 2 requires the 110 controls of NIST SP 800-171. Small suppliers in a prime’s supply chain are exactly the population that tends to discover this late.
- Do we need GCC High for CUI?
- Not automatically, and the honest answer depends on your contract terms and what data you actually hold. Some CUI can be handled in a properly configured commercial tenant; some contract clauses and some categories of data point to GCC High. That decision has real cost and migration consequences, so it is worth scoping before committing rather than after. Identra scopes it as a first step rather than assuming the answer.
- Are you based in Cedar Park?
- Identra operates remote-first across the United States, with on-site presence available for workshops and executive briefings. Most Cedar Park engagements are delivered remotely, which suits organisations whose sensitive work stays inside a controlled facility anyway.
- Does TAC 202 apply to the City of Cedar Park or Leander ISD?
- No. Texas Administrative Code Title 1 Chapter 202 applies to state agencies and institutions of higher education. Cities and school districts fall under Texas Government Code 2054.5191, introduced by House Bill 3834, which is an annual cybersecurity training and certification duty rather than a control catalogue.
- What is the typical Cedar Park engagement size?
- Eight to sixteen weeks. CMMC scoping work sits at the longer end because the first task is establishing what is in scope, and that answer changes the cost of everything after it. Fixed scope, fixed price.
04 / Related
Where this fits.
Industry
Defense contractor CMMC readiness
CUI scoping, NIST 800-171 control mapping and the GCC High decision.
Location
Microsoft 365 consulting Austin TX
Microsoft security consulting across Austin and the wider metro.
Solution
Microsoft security consulting in Texas
TAC 202, DIR standards and HB 300 across Texas organisations.