Do You Need GCC High for CMMC? A Decision Guide by CUI Category, Export Control & Deployment (2026)

Every defense contractor running Microsoft 365 asks the same question before spending a dollar on CMMC: do I actually need to migrate to GCC High? And every article they find gives them a version of the same hedge: "you may need GCC High if you handle CUI..."

There is a reason those articles hedge. Almost all of them are written by Microsoft partners who make their margin selling GCC High migrations. Saying "actually, GCC is enough for most contractors" costs those partners a $20-per-user-per-month upgrade and a six-figure migration engagement. So they don't say it, even when it is true.

This guide is written by a vendor that does not sell any Microsoft 365 tenant. We build an on-premises compliance platform. Our answer to "do you need GCC High" does not change our revenue either way, which means we can afford to give you the answer instead of the hedge.

Why this is really a question about email

Most articles frame the GCC High decision as "do I have CUI." That framing hides the real question. The real question is how CUI moves in and out of your business.

Consider what any competent enclave already handles:

• Storing CUI. Files on a hardened workstation, a network share inside a segregated VLAN, an on-premises platform. All routine.
• Processing CUI. CAD work, engineering analysis, documentation authoring, review workflows. All routine.
• Access control. AD/entra ID isolation, RBAC, MFA on the CUI enclave. All routine.

Now consider what an enclave does not handle on its own:

• Sending CUI by email to a customer or prime. The moment a user has to reply to a customer email with a CUI drawing attached, they reach for Outlook, and Outlook lives in your M365 tenant.
• Receiving CUI by email from a customer or prime. The prime sends an RFI with a CUI attachment. That attachment lands in Exchange Online. Exchange Online is your M365 tenant.
• Sharing CUI with external collaborators via Teams or SharePoint. Same story: the sharing infrastructure is M365.

Everything in that second list is transmission, and transmission is what forces the tenant question. If CUI never has to travel through M365, your M365 tenant does not have to be GCC High. If CUI does need to travel through M365, then your tenant does, because the M365 email and collaboration infrastructure is what is now handling CUI at rest and in transit.

This is what purpose-built CUI tools like PreVeil actually solve. They are not primarily CUI storage tools, even though they can store files. They are compliant transmission channels for CUI: an alternate email path that does not touch your M365 tenant. Users get a PreVeil client alongside Outlook. Anything CUI goes through PreVeil. Everything else goes through Outlook. The tenant boundary holds because the transmission channel for CUI is elsewhere.

Decision tree: which tenant do you need?

Answer these questions in order. The first "yes" that applies to your contract determines your minimum tenant.

The step that matters most is Step 3, and it is the step the majority of articles skip. If your export-controlled data lives in a purpose-built CUI tool that carries its own US-person operations, the M365 tenant is not the one enforcing that requirement, so the tenant does not have to be GCC High. Many small ITAR contractors satisfy their obligations with Commercial or GCC plus a dedicated CUI tool, at a fraction of the cost and complexity of a full GCC High migration.

Microsoft 365 tenant comparison for CMMC

Every attribute below is the property of the tenant itself, not your configuration. Your configuration determines whether you pass a CMMC Level 2 assessment; the tenant determines whether you were allowed to store CUI there in the first place.

Pricing is approximate and based on 2026 public list rates for M365 E3 equivalent SKUs; enterprise agreements, government incentives, and add-on services materially change effective cost. Verify current pricing with your Microsoft partner.

What actually forces GCC High

There are exactly two things that force GCC High. Neither is "you handle ITAR data." Both are more specific than that. Every other reason you have heard is either preference, hedge, or a partner selling you the upgrade.

1. Export-controlled technical data living inside your M365 tenant

ITAR (International Traffic in Arms Regulations, 22 CFR 120-130) governs defense articles and defense services on the US Munitions List. EAR (Export Administration Regulations, 15 CFR 730-774) governs dual-use items on the Commerce Control List. Both require that access to controlled technical data be limited to US persons (US citizens, permanent residents, and certain protected individuals). Non-US-person access to that data is a "deemed export" and requires an export license you almost certainly do not have.

Microsoft 365 Commercial and GCC use global support staff who may be non-US persons, so if export-controlled data sits in the tenant, the tenant itself has to enforce US-person-only access. GCC High is the Microsoft answer to that: physically segregated infrastructure staffed exclusively by screened US persons.

The critical qualifier is where the data lives. The US-person requirement follows the export-controlled data, not the organization. If you route that data through a purpose-built CUI tool that enforces its own US-person controls (PreVeil, Aerofiler/Aeroplicity, Kiteworks, or an on-premises CUI platform), and you document that M365 never touches it, then M365 is not in the ITAR/EAR scope. Your tenant choice reverts to whatever your other CUI in M365 requires (GCC for non-export-controlled CUI, Commercial for no CUI at all). See the workaround pattern below.

2. Explicit contract requirement

Some primes and program offices write GCC High into the SOW or a Contract Data Requirements List regardless of what the underlying data classification requires. This is common on programs where the prime standardized on GCC High and wants uniform sub-tier environments. It is contract language, not regulation, but it binds you the same way.

Read your contract before deciding. Search for "GCC High," "US persons only," "sovereign cloud," and any Data Rights or Export Control clauses. If those requirements appear in the contract, no amount of technical parsing gets you out of the GCC High requirement. Even the workaround pattern below does not override contract language.

When GCC (not GCC High) is enough

Microsoft 365 GCC is FedRAMP Moderate authorized. FedRAMP Moderate is the exact baseline DFARS 252.204-7012 calls out as the required standard for cloud services handling CUI. That is the entire regulatory hurdle for cloud storage of CUI under DFARS 7012. GCC clears it.

GCC is the right choice when all of the following are true:

• You handle CUI (so Commercial is not an option).
• None of your CUI carries ITAR or EAR export-control markings.
• No CUI//SP-CTI (Controlled Technical Information) is in scope, or the CTI you handle does not include export-controlled technical data.
• Your contract does not explicitly require GCC High or a US-person-only environment.
• You want to remain in the Microsoft 365 ecosystem rather than moving CUI to a separate enclave.

This describes a large share of small defense contractors: cleared shops doing manufacturing, IT services, professional services, sustainment work, or supplying non-export-controlled parts to primes. If that is you, GCC gives you a compliant answer for roughly a third less licensing cost than GCC High, without the migration complexity or the reduced third-party integration surface.

GCC eligibility is screened. You need a US-based organization supporting a US federal, state, or local government mission, or a contractor delivering to one. Applying takes a few weeks. Once approved, migration from Commercial to GCC is technically similar to any other Microsoft 365 tenant migration, without the export-control screening overhead of GCC High.

When Microsoft 365 Commercial is fine

Not every DoD contractor handles CUI. If your organization sees only Federal Contract Information (FCI), the broader class of contract-related information that is not marked CUI, you are at CMMC Level 1, not Level 2, and DFARS 7012 does not apply to your Microsoft 365 tenant.

Commercial is the right choice when:

• You have DoD contracts but the work does not generate or receive CUI (typical for suppliers of commercial off-the-shelf items, general services, or logistics).
• You are subject to CMMC Level 1 (15 basic safeguarding requirements from FAR 52.204-21), which does not carry the FedRAMP Moderate cloud requirement.
• You have documented and enforced a boundary that keeps CUI out of Microsoft 365 entirely. For example, CUI is handled only in a separate enclave, and email addresses tied to CUI programs are not on the M365 tenant.

The workaround pattern: keep CUI transmission out of M365

This is the pattern most articles do not explain. It is legitimate, widely deployed across the DIB, and can eliminate the need for a GCC High migration for a large share of contractors who think they need one.

The pattern in one sentence: route CUI transmission (specifically email and external file sharing) through a purpose-built secure channel that does not touch your M365 tenant, keep CUI storage and processing in your enclave, and document the boundary so M365 is provably outside CUI scope.

The reason this works is the reason spelled out in the section above: an enclave already handles CUI storage and processing without difficulty. What forces the M365 tenant question is transmission, specifically email. Take email out of M365 for CUI, and the M365 tenant is no longer handling CUI at all.

How it works

1. Stand up a purpose-built secure email and file-sharing channel that carries its own FedRAMP-authorized deployment and, if you handle export-controlled data, its own US-person operations. Common options are named below.
2. Route all CUI email through that channel. Inbound RFIs from the prime, outbound deliverables to the customer, engineer-to-engineer file exchanges. Nothing that is CUI goes through Outlook, Exchange Online, external Teams shares, or SharePoint external sharing.
3. Store and process CUI wherever your enclave lives (on-premises platform, hardened workstation VLAN, virtual desktop enclave). That side does not need to be M365 at all.
4. Configure and document the M365 boundary. DLP rules blocking CUI patterns from leaving the M365 tenant, mail-flow rules on senders known to transmit CUI, user training on which channel to use, and periodic evidence collection showing the separation held.
5. Choose your M365 tenant based on whatever CUI (if any) is still in scope for M365. If none, Commercial is fine. If non-export-controlled CUI is stored in M365 SharePoint or OneDrive but transmission happens elsewhere, GCC is the minimum for that storage.

Purpose-built CUI transmission channels commonly used in this pattern

The tools below are best understood as compliant email and file-transfer channels that run in parallel to your M365 tenant. Users get the purpose-built tool alongside Outlook. Anything CUI goes through the purpose-built tool; everything else stays in M365. That is how the pattern keeps CUI transmission out of the M365 tenant.

Done right, this pattern is not a compromise. It is often the most sensible architecture for a small contractor whose export-controlled work is a well-defined slice of the business. The alternative, migrating the entire company to GCC High for the sake of a handful of ITAR-controlled workflows, is often the more expensive and less flexible answer. Discuss the pattern with your Registered Practitioner and export-control counsel before committing to either path.

Other alternatives to GCC High

Beyond the workaround pattern above, contractors evaluating GCC High should also consider these full-tenant alternatives.

CUI enclave outside Microsoft 365

Stand up a bounded environment (a virtual desktop enclave, a hardened physical workstation environment, or a small on-premises platform) that is the only place CUI ever renders. Keep the rest of the business on Commercial. Only the enclave is in CMMC scope. This works well when CUI touches a small slice of your business (a specific program, a specific team, a specific set of drawings) rather than being pervasive.

Full details are in the CMMC Enclave Strategy guide.

On-premises or air-gapped platforms

If your objection to GCC High is fundamentally about not wanting CUI in any cloud tenant (boundary complexity, sovereignty concerns, or a preference for physical control), an on-premises platform keeps CUI on hardware you own and operate. This is 1TEN's model. It removes the cloud vendor from your assessment boundary entirely, at the cost of running hardware in your own facility.

AWS GovCloud (US)

AWS GovCloud is the equivalent conversation on the AWS side: two regions (GovCloud West and East) with US-person-only operations, FedRAMP High authorization, and ITAR eligibility. For contractors already invested in AWS rather than Microsoft, GovCloud is the analogous choice to GCC High. The decision framework is the same. Export-controlled data or contract language forces GovCloud; otherwise standard AWS commercial regions with a properly bounded CUI workload may satisfy DFARS 7012.

Google Workspace Assured Controls

Google offers Workspace configurations aimed at CJIS and defense customers. Adoption in the DIB is materially smaller than either Microsoft or AWS, and third-party CMMC tooling around the Google stack is thinner. Viable but the smallest of the three ecosystems.

Why some contractors are moving away from GCC High

GCC High solves the export-control problem. It also introduces problems of its own that contractors do not always price into the migration decision. A minority (but a growing one) is now moving CUI out of GCC High into enclave or on-premises architectures, keeping the rest of the business on Commercial.

The common reasons:

• Third-party integration gaps. Many enterprise ISVs (project management, CAD collaboration, accounting, HR) either do not offer GCC High connectors or offer them at higher tiers with delayed feature parity. Users end up with two workflows: one in GCC High for CUI, one in Commercial for everything else.
• Feature-parity lag. New Microsoft 365 features typically ship in Commercial first, then GCC, then GCC High, sometimes with multi-quarter lag. Copilot rollout followed this pattern.
• Boundary sprawl. The whole GCC High tenant is in CMMC scope. If your CUI touches a small share of the business but the tenant hosts everyone, everyone is in scope. Enclave architectures shrink that.
• Cost. Licensing plus migration plus reduced ISV options plus operational overhead often runs $30,000 to $75,000 per year higher than commercial equivalents for a 25-user tenant. That is real money for a small contractor.
• Lock-in. Migrating out of GCC High is materially harder than migrating in. Contractors that jumped early sometimes want a smaller cloud footprint later and find the exit path more expensive than they expected.

None of this makes GCC High wrong. For ITAR contractors, it is the right answer. It does mean the "GCC High or nothing" framing that dominated 2020-2024 no longer fits every contractor.

Decision checklist

Before signing anything, work through this list. If your answers change during the exercise, you have discovered your real tenant requirement.

If you cannot answer these confidently, the answer is not "migrate to GCC High now." The answer is "answer these first, then decide." A wrong tenant choice is expensive to reverse.

What the tenant choice does not solve

Choosing the right tenant is table stakes. It gets you to a compliant foundation. It does not, by itself, get you to CMMC Level 2 certification.

Regardless of which tenant you land on, you still have to implement all 110 NIST SP 800-171 controls in that environment, generate a substantive SSP that maps to your actual configuration, track a SPRS score, manage a POA&M for any deficiencies, run an internal assessment, and be prepared for a C3PAO third-party assessment. The tenant provides a compliant substrate. Your configuration and documentation do the rest.

See the CMMC Shared Responsibility Matrix guide for what Microsoft is actually responsible for in each tenant versus what stays on you.

Frequently asked questions

Related reading