Before GCC High, map your CUI boundary

"Do we need GCC High?" is one of the first questions we hear from defense contractors, usually right after a customer mentions CMMC, and often right after a vendor has quoted a migration.

It's a fair question. But it's the third or fourth question to answer, not the first.

What the rules actually say about cloud

If you use an external cloud service provider to store, process or transmit covered defense information, DFARS clause 252.204-7012 requires that provider to meet security requirements equivalent to the FedRAMP Moderate baseline, and to meet the clause's cyber incident reporting and related requirements. (DFARS 252.204-7012) The CMMC rule points back to the same clause for cloud providers that handle CUI, and puts their services in your assessment scope. (32 CFR 170.19)

Notice what that requirement attaches to: the cloud services that touch CUI. Not every mailbox, every department or every workload in the company.

The boundary decides the architecture

Before choosing a tenant, a product or a migration plan, answer four questions:

1. What CUI do you actually receive or create? Drawings, specifications, technical data, contract documents. Name the types, and where each comes from.
2. Who needs it? Usually a defined group: engineering, program management, a few people in quality or purchasing. Rarely the whole company.
3. Where does it go? Email, file shares, CAD and PLM systems, shop-floor machines, collaboration with customers and suppliers. Follow it end to end.
4. What else is driving the decision? Customer requirements, export-controlled data or other contract terms may narrow your options. Confirm which apply to you, rather than assuming. Microsoft itself says its Office 365 GCC High and DoD environments are the ones that support customers who need DFARS 7012, NIST 800-171 and ITAR compliance. (Microsoft Learn)

With those answers you can compare real options: moving everything, building an enclave for the people and systems that handle CUI, or something in between. Each has different costs, licensing, training and day-to-day friction. An enclave that's too small breaks workflows; a company-wide migration that wasn't needed spends money you could have used to close actual gaps.

Don't forget the shared-responsibility part

A government cloud tenant doesn't make you compliant on its own. The provider covers its share of the requirements; your configuration, your users, your policies and your MSP's work cover the rest. That split should be documented, and your SSP needs to describe how the cloud service fits into your boundary. (32 CFR 170.19)

Scope first. Spend second.

If your CUI already sits in a Microsoft 365 commercial or GCC tenant, Microsoft 365 Hardening starts with a boundary sketch and a plain answer on whether that tenant is the right home for it, before any licensing decision. On any other platform, or if you're unsure where CUI travels, the Level 2 Readiness Assessment confirms the boundary and reviews all 110 requirements against it, so the architecture you choose is the one you actually need.

Sources

1. DFARS 252.204-7012: Safeguarding covered defense information and cyber incident reporting (checked Nov 3, 2026)
2. Microsoft Learn: Cloud feature availability for US Government customers (checked Nov 4, 2026)
3. 32 CFR 170.19: CMMC scoping (checked Nov 3, 2026)

General information, not legal advice. Your contracts decide which requirements apply to you.