Why this decision comes first
DFARS 252.204-7012 requires cloud services that store or process CUI to meet the FedRAMP Moderate baseline or equivalent, and to support DoD incident reporting. Commercial Microsoft 365, Google Workspace and consumer file-sharing tools generally don't meet that bar for CUI. So before remediation starts, you need to decide where CUI will live.
Option 1: Move the whole company to Microsoft 365 GCC High
GCC High is Microsoft's US sovereign cloud for defense contractors. Email, Teams, SharePoint and OneDrive run in a US-only environment that supports DFARS 7012 and ITAR.
- Best when: CUI shows up across most of the business, such as engineering, purchasing, quality and the front office, or you also handle ITAR data.
- Trade-offs: licenses cost more than commercial plans, some third-party apps and integrations aren't available, and the migration needs careful planning. You also need eligibility validation before you can buy.
Option 2: A dedicated CUI enclave
An enclave is a separate, locked-down environment, often a small set of GCC High accounts or a secured virtual desktop, used only by the people and processes that handle CUI. Everything else stays where it is.
- Best when: only a handful of staff, such as engineering and contracts, touch CUI, and it arrives through predictable channels.
- Trade-offs: the boundary has to hold. That means training and technical controls so CUI doesn't leak back into commercial email or local drives.
What we do
- Map how CUI arrives and moves today, and recommend the option with the smallest workable scope.
- Handle GCC High eligibility, licensing and tenant setup, including conditional access, MFA, FIPS-compliant settings, data loss prevention and audit logging.
- Migrate mailboxes, files and Teams with a cutover plan that avoids lost email or broken links.
- Lock down devices with Intune policies that match your System Security Plan.
- Train staff on what goes where, with simple rules and labels so they don't have to guess.
- Support the environment afterwards, so it stays compliant as people and projects change.
Questions about gcc high & cui enclaves
How long does a GCC High migration take?
For 10 to 75 users, plan for six to twelve weeks including eligibility validation, tenant build, testing and cutover. An enclave for a few users can be ready faster.
Will our ERP or CAD software work?
Usually, but we check. Some SaaS products don't connect to GCC High, and some CAD workflows need a plan for large files. We test the critical ones before cutover.
