We advise investing in Microsoft Government Community Cloud (GCC) High
Microsoft 365 GCC High is deployed on Azure Government, within exclusive US data centers.
GCC High is the only Microsoft service—apart from the DoD-specific Microsoft 365—that ensures all
data is stored in U.S. data centers and managed by background-checked U.S. personnel.
These characteristics make GCC High the compliant choice for handling ITAR and EAR data.
Moreover, Microsoft 365 GCC High serves as an appropriate cloud platform for storing Controlled Unclassified Information (CUI) both
corporately and on behalf of the Government, which mandates DISA IL 4 or higher. GCC High is rated at
DISA IL 5 and is equivalent to FedRAMP High.
Advantages of Microsoft GCC High
#1: Microsoft Endorses GCC High for Cybersecurity Maturity Model Certification (CMMC) 2.0 Levels 2-3
Although Microsoft includes GCC within its accreditation scope for GCC, it still recommends handling
Controlled Unclassified Information (CUI) in GCC High. Microsoft advises using GCC for Level 1.
#2: Support by US Persons
This requirement ensures that only U.S. citizens or permanent residents on U.S. soil can access sensitive data on defense-related projects. It's designed to protect national security by keeping sensitive information within trusted hands. This includes third parties and secure cloud providers.
#3: Integration with Microsoft 365
The DoD version of Microsoft has not enabled B2B communication or collaboration between M365 DoD and
either Commercial or GCC. GCCH is the only platform version capable of B2B interactions with DoD.
#4: ITAR or NOFORN Data
Companies are prohibited from handling or storing ITAR data on Commercial or GCC platforms because
the data could be accessed by non-US persons through Microsoft's administrative processes, leading to
unauthorized and unintended exports.
#5: Prime Contractors
Most major prime contractors are transitioning or have already transitioned to GCCH. These primes
find it easier to collaborate and communicate with subcontractors who are also on GCCH. Additionally,
many primes prefer and trust companies using the same platform.
#6: Dual Migration, Configuration, and Assessment
GCCH ensures long-term compliance. If a company secures a contract or task order that includes ITAR
data, it would need to decide between declining the award or undergoing a second migration and
security setup.