Do You Really Need GCC High for CMMC? What DFARS 7012 and Microsoft Actually Say

Microsoft 365 GCC High is one of the biggest real costs of getting ready for CMMC. Some defense contractors need it. Others are told they need it when a different Microsoft cloud would meet their requirements. The deciding factor is the data you handle, not the size of your company.

What the rule requires of your cloud

DFARS 252.204-7012(b)(2)(ii)(D) says that if you use an external cloud service provider to store, process or transmit covered defense information, you must require and ensure that the provider:

• Meets security requirements equivalent to the FedRAMP Moderate baseline- Complies with paragraphs (c) through (g) of the clause: cyber incident reporting, malicious software, media preservation and protection, access for forensic analysis, and cyber incident damage assessmentThose paragraphs include reporting within 72 hours of discovery and preserving images of affected systems for at least 90 days. The DoD CIO's December 21, 2023 memo explains "equivalent." A FedRAMP Moderate Authorized service already meets the requirement. A service that isn't authorized must reach 100% compliance with the latest FedRAMP Moderate baseline, assessed by a FedRAMP-recognized Third Party Assessment Organization, and give you a body of evidence. ## Commercial, GCC or GCC High
• Commercial: Microsoft positions Microsoft 365 for enterprise for CMMC Level 1, which covers FCI.- GCC: Microsoft lists GCC as supporting DFARS. It can work for CUI that isn't export-controlled, if your contract and prime allow it.- GCC High: Microsoft built it for DoD contractors handling CUI or data subject to ITAR. Microsoft's CMMC FAQ says GCC isn't suitable to hold CUI Specified, such as ITAR, because that data requires US sovereignty, which only GCC High offers. Microsoft staff with access to GCC High customer content must be verified US citizens.If you handle ITAR or EAR technical data, or your contract requires US-only support, plan on GCC High. ## Why it costs so much
• Licensing costs more, and it is sold through volume licensing after an eligibility validation. Microsoft offers no trials.- It is a separate environment, so you migrate mail and files into it. File sharing in SharePoint and OneDrive works only with other GCC High organizations.- Microsoft notes GCC High and GCC lack feature parity with commercial, so some tools and workflows change.## Before you buy
• Map where CUI enters, lives and leaves your company.- Identify any ITAR or EAR data, and read your contract and prime's flow-down terms.- Decide whether a smaller CUI enclave makes more sense than moving every user.- Write the decision into your SSP so your assessor can follow it.## Start here Cyberneza is a veteran-owned, 100% US-based cybersecurity and compliance firm in Orlando, Florida. Our expert-led reviews assess your data, map your CUI and specify the right cloud before you spend on licenses: https://cyberneza.com/cmmc Sources: DFARS 252.204-7012, DoD CIO FedRAMP Moderate Equivalency memo, Microsoft and CMMC, Office 365 GCC High and DoD, Microsoft DFARS offering