MLZ is not CMMC Level 3 compliant out of the box

[baswelsh]

Description

The spec CMMC Level 3 deployment has the following policy violations which I would expect the MLZ to be in compliance with out of the box. Am I required to manually bring these resources into compliance? Is there a timeline for the MLZ to handle these? It looks like (at least in the case of the NSG flow logs) this project used to correctly configure the relevant resources back when the implementation was Terraform.

Hub

Operations

Shared Services

Steps to Reproduce

Deploy this fork with command:

az deployment sub create \
  --subscription $mlzHubSubscriptionId \
  --location 'usgovarizona' \
  --template-file './mlz.json' \
  --parameters \
      resourcePrefix='<redacted>' \
      environmentAbbreviation='prod' \
      hubSubscriptionId=$mlzHubSubscriptionId \
      identitySubscriptionId=$mlzIdentitySubscriptionId \
      operationsSubscriptionId=$mlzOperationsSubscriptionId \
      sharedServicesSubscriptionId=$mlzSharedServicesSubscriptionId \
      deployPolicy='true' \
      policy='CMMC' \
      deployDefender='true' \
      deployDefenderPlans="['KubernetesService','Containers','OpenSourceRelationalDatabases','StorageAccounts']" \
      emailSecurityContact='<redacted>' \
      location='usgovarizona' \
      firewallSkuTier='Premium' \
      tags="{'org': '<redacted>', 'instance': '<redacted>'}"

Expected behavior

Default MLZ deployment resources to be fully compliant with assigned policies

Actual behavior

MLZ deployment resources are not fully compliant with assigned policies (see screenshots above for specific instances)

Screenshots

(see above)

Additional context

Operating System: MacOS
Cloud (public, Azure Government, etc.): Azure Government

Really appreciate the help on this!