CMMC Compliance without GCC High

Hi pvalad530   Cybersecurity frameworks are applied to all Microsoft cloud environments consistently across the spectrum of services. Cybersecurity 'maturity' is often represented as the efficacy of process and automation of practices. There are specific control requirements that are unique to each cloud environment. For example, sovereign clouds such as Azure Government and Microsoft 365 Government (GCC High) have controls in place for restricting access to only screened US persons with data processing and storage only within the Continental United States (CONUS). Sovereign clouds are more restricted in terms of the specificity of control requirements in relation to other cloud environments. Even though control requirements may vary from one cloud environment to another, each may demonstrate a level of cybersecurity maturity in alignment with CMMC.

The two most commonly discussed requirements that drive our customers into Microsoft 365 Government (GCC High) are:

1. DFARS 7012
2. CUI containing a higher watermark for compliance (e.g. ITAR)

In other words, CMMC by itself will not be the decision factor on choosing which environment is most appropriate. Most DIB companies requiring CMMC Level 3+ are best aligned with Azure Government and Microsoft 365 GCC High for DFARS 7012 and for data handling of CUI. For more information, please refer to
Understanding Compliance Between Microsoft 365 Commercial, GCC, GCC-High and DoD Offerings

and Microsoft US Sovereign Cloud Myth Busters - CUI Effectively Requires Data Sovereignty.