Working with the Department of Defense? You’ll need to get certified.

This approach anchors on your confidence in achieving compliance while remaining on-premises (e.g., keep email, file servers, etc.) and demonstrating it at a cost that is reasonable. Consider if you need users to access data from anywhere. We find that the cost is astronomical, and complexity to manage and operate is likely too burdensome to stay on-prem while scaling business.​

CMMC compliance can be expensive, and Microsoft has a purpose-built platform in GCC High to help organizations achieve requirements from the DoD. GCC is not suitable to hold CUI Specified (e.g., ITAR, Nuclear, etc.). This type of data requires US sovereignty, which is only offered by GCC High.​

Federal, State, and Local US Government agencies, as well as commercial companies, holding Controlled Unclassified Information (CUI), Criminal Justice Information (CJIS), and export-controlled data (ITAR/EAR) find that the Microsoft 365 Government Cloud offers the most robust set of capabilities while meeting necessary regulatory controls. Some of the parity items are by design because you need to apply concepts like zero trust from the start.

Not working with government or DoD contracts doesn’t necessarily mean that you don’t need CMMC compliance. The basic principles of CMMC compliance relate to proactive and consistent security best practices. In addition, CMMC might still apply because you might provide a service to companies that need to comply with CMMC. This means they will flow down the requirements to you.

We find a lot of organizations use a variety of security and collaboration products. But managing that system/compliance boundary is difficult and increases risk. The G3 and G5 package already includes security and compliance capabilities that natively integrate across the Microsoft platform. ​

The migration process would be similar to migration from any other cloud/on-premises. It is suggested that you allocate at least 3 months for the migration phase and leverage tools to facilitate the process.​

If you have multiple business units, the suggestion is to put all of them in one cloud environment with GCC High. This gives you the high bar of security requirement, irrespective of the specific compliance requirements of that business unit and the information you are controlling.

A data enclave might seem to be a quick and easy to deploy, and often maps 1:1 with a data enclave that is on-premises today. It may also considered to be much less expensive than alternative approaches that place more users and workloads into GCC High.​

However, we have seen with organizations that the most common spillage happens through personal storage, especially in e-mail. If your Personal Data solutions are not hitting the high bar for compliance, or worse, if they are hosted in a Commercial cloud, you have much more scope outside the accreditation boundary than where your Shared Data resides. Check the blog for more details: The Microsoft 365 Government (GCC High) Conundrum - DIB Data Enclave vs Going All In