Microsoft 365 GCC and GCC High Deployment
Address your complex compliance needs with Government Community Cloud and GCC High, Microsoft’s secure cloud solutions designed to meet federal requirements
Seamless M365 GCC and GCC High migration for government contractors
As a federal or defense contractor seeking to comply with contractual obligations, Microsoft 365 Government Community Cloud (GCC) and GCC High provide an easy path to meet your requirements. However, the process of migrating critical business infrastructure without impacting your business can feel daunting.
That’s where C3’s professional IT services come in. With more than 10 years of experience selling, deploying, and managing Microsoft 365 environments for the Defense Industrial Base and other federal contractors, we bring unparalleled expertise to the migration process.
With hundreds of deployments under our belt, we’ll get you up and running on either GCC or GCC High painlessly.
Your CMMC journey
CMMC compliance starts with GCC High
Defense contractors seeking to achieve CMMC Level 2 compliance should plan to implement GCC High, particularly if you hold export-controlled data under ITAR or EAR or if you hold other types of Controlled Unclassified Information (CUI) Specified that require U.S. data sovereignty.
Microsoft GCC High enables a compliant platform to support your IT environment, core communications, and collaboration services. GCC High will satisfy many of the controls within CMMC and is a critical tool in your overall compliance strategy, including a core component of the C3 Suite of CMMC solutions including C3 Command and C3 Catalyst.
What is Microsoft GCC?
GCC and GCC High are versions of the Microsoft 365 service suite created to support federal civilian agencies, contractors, and state and local governments. GCC High was specifically designed to support the compliance requirements of the U.S. Defense Industrial Base (DIB).
Both versions include the same productivity services as commercial Microsoft 365, including:
- Email (Outlook)
- File sharing (SharePoint)
- Teams collaboration
- Microsoft’s security offerings, such as Entra, Intune, and Defender.
In addition, GCC and GCC High store Microsoft 365 data (email, file shares, collaboration) within the United States.
Unsure whether you need GCC or GCC High?
If you’re asking yourself: “Does CMMC require GCC High?” download a copy of our Buyer’s Guide to learn more.
Download the GCC / GCC High eBook
Licensing GCC High for small and midsize businesses
If you’re a small or mid-sized business, procuring GCC High licenses can be a little more complicated. Companies seeking to purchase fewer than 500 GCC High licenses need to go through an authorized Microsoft partner through the Microsoft Agreement for Online Services – Government (AOS-G) program.
As an original AOS-G partner, C3 can help you provision GCC High licenses without requiring an Enterprise Agreement with Microsoft. C3 has worked with hundreds of small and medium sized businesses to deploy GCC High, bringing a level of affordability to all members of the DIB.
FAQs
What is Microsoft 365 GCC and who needs it?
Microsoft 365 GCC (Government Community Cloud) is a specialized cloud environment designed to support federal civilian agencies and contractors, as well as state and local governments. It contains the same productivity services as commercial Microsoft 365, including email (Outlook), file sharing (SharePoint), and Teams collaboration, as well as Microsoft’s security offerings, such as Entra, Intune, and Defender. While all of its data is stored in the United States, it shares services with Azure Commercial, which means that some data processing (such as user authentication) and support may occur outside of the United States, making it a poor choice for organizations with data sovereignty requirements. Microsoft 365 GCC does meet the requirements in DFARS 252.204-7012 for cloud service providers to achieve the FedRAMP Moderate baseline and support contractor compliance around incident reporting, media preservation and protection, and damage assessment requirements for the processing, storing, and transmission of Controlled Unclassified Information (CUI) in the cloud.
What is Microsoft 365 GCC High and who needs it?
Microsoft 365 GCC High (Government Community Cloud High) is a specialized cloud environment specifically designed to support the compliance requirements for the U.S. Defense Industrial Base. Like Microsoft 365 GCC, it includes all the same productivity services as commercial Microsoft 365 (email, file sharing, Teams, security, etc.), but is designed for organizations that handle Controlled Unclassified Information (CUI) and need to meet stringent federal compliance requirements including CMMC Level 2, NIST SP 800-171, ITAR, and DFARS 7012. Defense contractors and other organizations in the Defense Industrial Base typically need GCC High to meet their contractual obligations with the Department of Defense.
What is the difference between GCC, GCC High, and commercial Microsoft 365?
Commercial Microsoft 365 is designed for general business use. GCC (Government Community Cloud) is for federal civilian agencies and contractors, as well as state and local government. While all 365 data (email, file shares, collaboration) for both GCC and GCC High is stored in the United States, GCC does share services with Azure Commercial, which means that some data processing (such as user authentication) and support may occur outside of the United States. In contrast, GCC High is a more secure, isolated environment that meets DoD Impact Level 4 and 5 requirements, with physical and logical isolation from commercial services, screening of support personnel, and was built as a “US Sovereign Cloud”, which uses Azure Government and only relies on U.S. Persons. Both GCC and GCC High meet compliance requirements outlined in NIST 800-171 and DFARS 7012 and support the handling of CUI; however, organizations that require data sovereignty (e.g., for ITAR-controlled and NOFORN information) will require GCC High.
How long does it take to migrate to Microsoft 365 GCC or GCC High?
Migration timelines vary based on your organization’s size, current infrastructure, and data complexity. With C3’s experience deploying GCC High for over 150 defense industry customers across more than 10 years, we’ve refined the migration process to be as efficient and painless as possible. C3 handles the technical complexity while minimizing disruption to your business operations.
Is C3 qualified to deploy Microsoft 365 GCC or GCC High?
Yes, C3 Integrated Solutions is one of the original five Microsoft partners authorized to resell GCC and GCC High licenses. With over 10 years of experience deploying and managing Microsoft 365 for the Defense Industrial Base and more than 150 defense industry customers successfully migrated to either GCC or GCC High, C3 is a leading provider with deep expertise in this specialized environment.
Can I use my existing Microsoft 365 licenses in GCC High?
No, both GCC and GCC High require separate licensing from commercial Microsoft 365. The licensing structure and costs are different due to the enhanced security features and compliance capabilities. C3 can help you understand the licensing requirements and costs, procure the appropriate licenses, and ensure you have the right services configured for your needs.
Will my users notice a difference after migrating to GCC or GCC High?
While the user experience in GCC and GCC High is very similar to commercial Microsoft 365, there are some differences. Certain third-party integrations and apps may not be available in the GCC/ GCC High environment due to security restrictions. C3’s experienced team evaluates your business requirements, identifies potential impacts, and helps you plan for any necessary changes before migration to minimize user disruption.
What happens to our existing data during GCC / GCC High migration?
C3 manages the secure migration of your email, files, SharePoint sites, Teams data, and other content from your current environment to GCC / GCC High. Our migration process is designed to maintain data integrity, minimize downtime, and ensure business continuity. We also provide user training and support to ensure a smooth transition.
Does GCC / GCC High satisfy CMMC requirements?
Both Microsoft 365 GCC and Microsoft 365 GCC High are designed to meet NIST 800-171 and other federal compliance requirements that form the foundation of CMMC Level 2. However, achieving CMMC compliance requires more than just using GCC or GCC High—it requires proper implementation, configuration, documentation, policies, and ongoing management. C3’s combined expertise in GCC / GCC High environments and CMMC compliance ensures your environment meets all requirements.
Interested in learning more?
Talk to one of our experts.