I know the DoD's new "Basics" aren't requirements, but they are the only signal the department has provided to anyone about ... anything.

There's no scoping guide and the language within the basics is very broad.

"Every asset"?

"All intellectual property, proprietary data, and Department records"?

What is "sensitive data"?

What are "sensitive systems"?

What does "your estate" mean re: Asset Inventory Management?

They're reviewing the CMMC program which includes CMMC scoping guidance, but if the Basics are a signal, is scoping going to get more nebulous rather than more granular?

Anybody else worried about this?

Looking to backup GCCH enclave as well as some VMs in Azure Govt cloud. CUI as well as ITAR data. Looking for cloud to cloud backup solution without any on-prem infrastructure. I see that Avepoint has Fedramp Moderate and Commvault has High but having trouble getting a written answer from either regarding compliance for ITAR/export control. Perhaps I'm not asking the correct questions?