Government Requirements & Microsoft 365 GCC High Solutions

For organizations that work within the United States Defense Industrial Base, there is a wide array of compliance requirements needed depending on the given department, agency, and type of data and communication you are working with.

Below, we provide a brief overview of key terms and their origins, which is crucial for understanding how they will align with your requirements, ensuring you can implement the necessary security controls to adhere to federal government regulations for DoD contractors. If you know this already, navigate down to the Government Compliance Matrix to quickly dive deeper into what you’re looking for.

Leveraging Microsoft 365 GCC High and Azure Government to reduce the risk and overhead in achieving security and compliance requirements along with the productivity and innovation gains is a core motivator for many organizations.

Where does GCC come from?

The term Community Cloud originated from the National Institute of Standards and Technology (NIST) Special Publication 800-145, “The NIST Definition of Cloud Computing” (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf) Microsoft, therefore, has created Government Community Cloud (GCC) and Government Community Cloud High (GCCH) as separate cloud instances with distinct controls and requirements.

The following is a snippet from that publication:

---

What’s the difference between GCC and GCC High?

The Government attachment to the phrase “Community Cloud” and the distinguishment of Low, Moderate and High also come from NIST and leveraged by FedRAMP. 

The following snippet is from FedRAMP: https://www.fedramp.gov/baselines/

Federal Information Processing Standard (FIPS) 199 provides the standards for the security categorization of federal information and information systems. FedRAMP authorizes Cloud Service Offerings (CSOs) at the: Low (including Tailored Li-SaaS), Moderate, and High impact levels. FedRAMP Tailored was developed to support industry solutions that are low risk and low cost for agencies to deploy and use. Tailored policy and requirements provide a more efficient path for Low Impact-Software as a Service (LI-SaaS) providers. The LI-SaaS Baseline accounts for Low-Impact SaaS applications that do not store personal identifiable information (PII) beyond that is generally required for login capability (i.e. username, password, and email address).

Now we can put all this together and we get:

What is Microsoft GCC and GCC High

1. GCC is Office 365 paired with Microsoft Entra ID in Azure (Commercial). It is intended for contractors holding or processing data on behalf of the US Government that is not CUI or ITAR data.
2. GCC High is Office 365 paired with Microsoft Entra ID in Azure (Government). It is intended for contractors storing, processing, or transmitting Controlled Unclassified Information (CUI) or subject to International Traffic in Arms Regulations (ITAR) on behalf of the United States Department of Defense.

As defined by Microsoft: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/office-365-us-government#about-office-365-government-environments

Prepare & Validation

You’ve decided to move to a Microsoft 365 using either Government Community Cloud Moderate (GCC) or Government Community Cloud High (GCC High) to meet your Public Sector compliance requirements.

The next step is to get validated and understand licensing.

Below, we focus on key areas of planning and validation, whether you’re handing this independently, with another provider, or with Agile IT (our recommended choice 😊 ).

Licensing

Understanding the licensing options and process for either GCC is a critical part of an organization’s planning.

Microsoft 365 GCC

Licensing for GCC (aka GCC Moderate) is straight forward as it aligns with Microsoft 365 commercial (aka Global) infrastructure. However, it still requires you to get validated (the section lower on this page) and ensure you’re working with a Microsoft partner that is also approved to resell those licenses to customers (such as Agile IT).

The good news is product and feature availability, and the method of licensing and billing are virtually the same as commercial. While pricing can be slightly different in some areas, those difference are rare.

The Microsoft “Cloud Service Provider” program is intended to allow Microsoft partners to resell Microsoft licensing, but with some commitments to guidance, billing, and licensing support.

There are two types of CSP partners: Direct and Indirect.

• Direct is a partner that is invoiced from Microsoft directly for the licenses and consumption of their customers. (Agile IT is a Direct CSP partner)
• Indirect is a partner that utilizes a third-party service that offloads the Microsoft relationship and may even include added services including a requirement to pay for support.

Microsoft 365 GCC High

Licensing with GCC High is unique in many ways and often misunderstood.

The Microsoft Agreement for Online Services, Government (AOS-G) is the only way for organizations to purchase Microsoft 365 GCC High licensing without the requirement of purchasing a Microsoft Enterprise Agreement.

What you should know about licensing Microsoft 365 GCC High:

---

Select a category

• Your selection here will determine if you’re submitting for GCC or GCC High. 

Select the validation or service that you need

If you’re just “trying things out” or plan to do this all on your own (hopefully you’ve done this before), then you’re welcome to use any of the available options.

Recommendation:

Select, “General Validation” as this is really the most important step. This also prevents issues that can occur if you plan to use a Microsoft Partner, like Agile IT or with your existing Microsoft Large Service Provider (LSP), formerly known as a Large Account Reseller (LAR), in regards to licensing, tenant naming, activation, etc.

Organization & contact information

This page in the form will collect organizational and contact information.

Supporting Information (GCC)

When “US Federal, State, Local, or Tribal government entity” was selected (this is for GCC). You will only need to answer a few items listed below:

• Parent organization (if applicable): Enter parent organization name
• If your entity was created or authorized by a statute or regulation, please cite below.: Please describe
• Are you a Federally Funded Research and Development Center (FFRDC) or University
• Affiliated Research Center (UARC)? (Yes or No)
• Are you a US Tribal Entity? (Yes or No)
• Additional notes (optional):

Supporting Information (GCC High)

When “Customers handling government-controlled data” was selected (this is for GCC High). You will need to enter in your CAGE number, confirm your registration with any of the listed government agencies, and select whether or not you are registered with any Small Business Association.

With an understanding of the compliance requirements and Microsoft validation and licensing, it’s now time to focus on securing the environment and migrating your users and data.

Here, we focus on key areas to consider, address, and make decisions about the scope of migration, deployment of security services, and documentation on how you are meeting the controls within CMMC.

Agile IT Services for GCC High Onboarding & Migrations

At Agile IT, we’re not just proficient in addressing the complexities of government regulations and compliance standards while ensuring top-tier security measures – we excel at them, demonstrated by our Microsoft Partner of the Year award in Security and Compliance.

Our focus? Providing secure, compliant cloud solutions with Azure Government and Microsoft 365 GCC High. Designed to fit the distinctive needs of defense, federal, state, and local government organizations.

When a government subcontractor is seeking a Managed Service Provider (MSP) for Microsoft 365 Government Community Cloud (GCC) High to ensure compliance with CMMC (Cybersecurity Maturity Model Certification), there are specific criteria and considerations to keep in mind. The GCC High environment is designed to meet the stringent compliance requirements of the U.S. Department of Defense (DoD) and other federal agencies, so it’s essential to choose an MSP that understands and can navigate this unique environment.

Here are some key considerations and criteria to look for in ANY MSP:

In conclusion, when selecting an MSP for Microsoft 365 GCC High, it’s imperative to prioritize compliance, security, and experience. Given the unique requirements of the GCC High environment, partnering with an MSP that understands and can navigate these complexities will be invaluable. Agile IT is here to help!

Read more about our MSP service, AgileSecure, here.