While only Microsoft Sentinel/Microsoft Defender for Cloud are required to get started, each offering provides additional enrichment for aligning with control requirements. Each CMMC 2.0 control includes a Control Card detailing an overview of requirements, expected evidence required for each control, applicable Microsoft product/services controls, targeted to referenced product pages/portals, recommendations, implementation guides, and ability to track status, ownership, implementation date, location for referenced body of evidence, and notes.