Microsoft GCC High and CUI Enclaves for CMMC

What Microsoft GCC High is

GCC High is a separate Microsoft 365 environment built for the Department of Defense and for contractors that hold or process DoD controlled unclassified information (CUI) or data subject to ITAR ¹. It runs apart from commercial Microsoft 365, with its own tenant.

What Microsoft says about it:

• Purpose. GCC High and DoD environments deliver compliance with DoD Security Requirements Guidelines, DFARS and ITAR ⁴.
• Assessment basis. GCC High is assessed using NIST SP 800-53 controls at a FIPS 199 High categorization and can show IL4 equivalency or the inheritance needed for CMMC ¹.
• People. Microsoft staff with access to customer content must pass background checks including U.S. citizenship verification, and staff have no standing access to production ¹.
• ITAR. Microsoft agrees to ITAR contract language only for GCC High, not for standard GCC ⁴.

On FedRAMP: Microsoft states that standard GCC provides compliance with FedRAMP High ⁴. For a specific authorization level of the GCC High offering, check the FedRAMP Marketplace yourself before relying on it in your system security plan.

GCC High vs GCC vs commercial Microsoft 365

The right environment depends on the data you hold, not on CMMC alone. Microsoft's own Azure CMMC guidance says "the need for CMMC certification is not a deciding factor for choosing your cloud environment" ⁵.

A plain way to think about the three:

• Commercial Microsoft 365 (Business Premium, E3, E5) is what most companies use. Business Premium lists at $22 per user per month on an annual plan ⁶. It is common for companies with only federal contract information working toward CMMC Level 1.
• GCC is for government entities and other organizations handling government-regulated data, with eligibility validation and revalidation at each renewal ⁴. Microsoft will not sign ITAR contract terms for GCC ⁴.
• GCC High is for DoD contractors handling CUI or ITAR data, with stricter staffing controls and ITAR terms ¹⁴.

What the rule requires is the outcome, not a brand. DFARS 252.204-7012 says that if you use an external cloud service to store, process or transmit covered defense information, the provider must meet security requirements equivalent to the FedRAMP Moderate baseline and comply with DFARS incident reporting and related requirements ². The CMMC rule repeats that a cloud provider storing CUI must meet the FedRAMP requirements in 252.204-7012 ⁷. Contractors with ITAR data, or primes that require it, often choose GCC High. Others document why a different service meets 7012. Confirm the choice with your assessor or counsel.

Eligibility validation for GCC High

You cannot simply buy GCC High. Microsoft sells it through Volume Licensing only after an eligibility validation, and no trials are available ¹.

What Microsoft's documentation says about eligibility ⁴:

• Eligible organizations include government entities and other entities that handle government-regulated data such as ITAR or CJIS data.
• Validation may ask for proof such as State Department ITAR registration or government sponsorship.
• Eligibility must be revalidated at every renewal.

Many small contractors buy through a Microsoft partner that sells the government clouds and can help with the validation paperwork. Have your contract numbers, the DFARS clauses that apply, and any ITAR registration ready.

CMMC enclaves and scoping: the five asset categories

A CUI enclave is a separated environment that holds all your CUI so the rest of the company stays out of CMMC scope. The term is our plain-language description, but the basis is DoD's. The Level 2 Scoping Guide says separation "is required only for Out-of-Scope Assets," and that within an enclave the company decides which requirements it implements and which it inherits from the enterprise ³.

The Scoping Guide (Version 2.13, September 2024) and 32 CFR 170.19 sort assets into five categories ³⁷:

1. CUI Assets process, store or transmit CUI. Assessed against all Level 2 requirements.
2. Security Protection Assets provide security to the CUI environment (firewalls, identity, logging). Assessed against the requirements relevant to what they do.
3. Contractor Risk Managed Assets can, but are not intended to, touch CUI because of your policies and controls. Documented in the system security plan; they need not be separated from CUI assets.
4. Specialized Assets such as IoT, operational technology, government-furnished equipment and test equipment. Documented, but not assessed against other requirements.
5. Out-of-Scope Assets cannot touch CUI and are physically or logically separated from CUI assets.

Logical separation means preventing data transfer between connected assets; physical separation means no wired or wireless connection at all ³.

Common enclave patterns are a GCC High tenant used only by the people who handle CUI, while everyone else stays on commercial Microsoft 365, or a dedicated virtual desktop environment. An enclave shrinks the number of assets assessed, but it adds a second environment to run. Which is cheaper depends on how many people touch CUI. Our CMMC cost guide covers how scope drives cost.

GCC High migration and cost factors

A GCC High migration is a move to a new tenant, not an upgrade of your current one, so plan it as a project. We found no public Microsoft list price for GCC High that we could cite, unlike commercial plans, so get written quotes from a partner. The factors that drive cost:

• Licenses. Per-user GCC High licensing, quoted by your reseller. Fewer users in an enclave means fewer GCC High licenses.
• Migration tooling. A migration software vendor's 2026 guide puts Microsoft 365 migration tool licenses at $2 to $15 per mailbox, or $10 to $35 per user with document and drive add-ons, for migrations generally ⁸.
• Labor. The same guide puts external consultant labor at $150 to $250 per hour ⁸. GCC High work also needs people who know the government cloud's differences.
• Third-party apps. A tool that works with commercial Microsoft 365 may not be available for GCC High. Check every integration, including backup, email security and phone systems.
• Running costs. Logging, monitoring and identity controls still have to be operated to meet the NIST 800-171 requirements.
• Documentation. If a partner manages your tenant, your system security plan must document its role with a service description and customer responsibility matrix ⁷.

Sequence matters. Decide scope first, then licensing, then migrate, then document. For help, see Microsoft 365 support and cloud migration services, or the CMMC compliance services guide for providers who scope enclaves. The CMMC schedule may change while Phase 2 is paused, so check the DoD CIO CMMC page before setting migration deadlines around a C3PAO date ⁹. For the program overview, see the CMMC guide and CMMC Level 2 requirements.