-
By: Janina Criador - Cloud Computing
- Last Updated On: October 29, 2026
- Comments 0
- 12 min read
The Contract Has Arrived. Now Someone Must Answer: Where Is the CUI Going?
Controlled Unclassified Information (CUI) from a Department of Defense (DoD) contract must be stored and processed in an environment that meets NIST SP 800-171 and, for cloud services, FedRAMP Moderate or equivalent. For most defense contractors, that means a government cloud such as Microsoft 365 GCC High or Azure Government, not a standard commercial tenant.
The contract has been signed. The kickoff call is scheduled. Then someone in contracts forwards a clause reference to IT, and a question lands that nobody budgeted time for: where, exactly, will this data live? Email threads, shared drives, laptops, and subcontractor portals are all candidates, and most of them are not allowed to hold CUI.
The answer depends on what kind of CUI your contract carries, which clauses flow down to you, and whether export-controlled data such as ITAR or EAR material is involved. It also determines whether you can pass a CMMC assessment and keep your place on the contract.
This guide walks through what happens after a CUI contract arrives, which environments qualify, where contractors most often go wrong, and how to migrate without halting the work.
Stop guessing about your Microsoft licensing, security posture, or CMMC audit readiness. Let our certified cloud architects guide your next move.
TL;DR
- What CUI is: Unclassified information that the government requires you to protect, as defined by the NARA CUI Registry and flowed down through your contract.
- Where the requirement appears: Look for DFARS 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021, plus any CUI or export-control language in the statement of work.
- The baseline standard: NIST SP 800-171 defines the security controls. CMMC Level 2 is how the DoD verifies you meet them.
- Commercial cloud is rarely enough: DFARS 7012 requires cloud providers that handle CUI to meet FedRAMP Moderate equivalency. Commercial Microsoft 365 and, in many cases, GCC fall short, particularly for ITAR and export-controlled data.
- When GCC High applies: Microsoft 365 GCC High, built on FedRAMP High and DoD SRG Impact Level 4 and 5 controls, is the common choice for contractors handling CUI, with Azure Government covering broader workloads.
- Mistakes to avoid: Leaving CUI in commercial tenants, ignoring email and Teams, using unmanaged devices, and skipping backup and incident-reporting plans.
- Where to start: Identify the CUI in your contract, map where it flows, pick an environment that matches the data type, then migrate in phases.
- Who can help: ECF Data is an authorized Microsoft Partner and an AOS-G (Agreement for Online Services – Government) partner, delivering licensing, migration, architecture, and managed support across GCC High, DoD, and Azure Government environments.
What Is CUI, and How Do I Know If My Contract Includes It?
Controlled Unclassified Information (CUI) is unclassified information that the U.S. government creates or owns, or that is created for it, and that law, regulation, or policy requires agencies to safeguard. The program was established by Executive Order 13556 in 2010. It is governed by 32 CFR Part 2002, and the National Archives (NARA) maintains the official CUI Registry.
CUI is not secret. It is sensitive, and the rules for handling it are strict.
Contractors usually meet two kinds of protected information. The difference decides how much work you have ahead of you.
Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | |
Definition | Non-public information provided by or generated for the government under a contract | Information the government designates for safeguarding or dissemination controls |
Governing clause | FAR 52.204-21 | DFARS 252.204-7012 |
Baseline controls | 15 basic safeguarding requirements | 110 requirements in NIST SP 800-171 Rev 2 |
CMMC level | Level 1 | Level 2 or higher |
Typical examples | Contract performance reports, non-public pricing | Controlled technical information, export-controlled data, privacy data |
To find out whether your contract carries CUI, check four places:
- The clauses. DFARS 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021 signal that CUI, or “covered defense information,” is in scope.
- The statement of work. Look for references to technical data, drawings, specifications, or export-controlled material.
- Markings. Documents should carry CUI banner markings, though the government does not always apply them consistently.
- Your contracting officer. If the contract is unclear, ask in writing. Do not guess.
What Happens Right After a CUI Contract Arrives?
The first 30 days decide whether you are building a compliant environment or retrofitting one under pressure. DFARS 252.204-7012 applies from the day of award, and your SPRS score is checked before award under DFARS 252.204-7019 and 7020.
Here is a practical first-month sequence:
- Read the flow-down clauses. Have contracts, legal, and IT review them together.
- Identify what CUI is. Ask the prime or contracting officer for which deliverables and data sets are in scope.
- Map the data flow. Trace where CUI enters, who touches it, and where it is stored, emailed, printed, or backed up.
- Name one accountable owner. Shared ownership across contracts, IT, and security tends to leave gaps.
- Run a gap assessment against NIST SP 800-171. Document the results in a System Security Plan and a Plan of Action and Milestones.
- Choose the environment. Do this before anyone copies CUI into an existing system.
Flow-down matters here too. DFARS 7012 requires you to pass the clause to any subcontractor that handles covered defense information. If you are the subcontractor, your prime will expect the same evidence you would ask of your own suppliers.
What Do DFARS, NIST SP 800-171, and CMMC Actually Require for CUI?
Three frameworks cover this. DFARS 252.204-7012 is the contract clause, NIST SP 800-171 is the control set, and CMMC is the verification program.
- DFARS 252.204-7012 requires contractors to provide “adequate security” for covered defense information. It also requires reporting cyber incidents to the DoD within 72 hours and preserving affected images for at least 90 days.
- NIST SP 800-171 Rev 2 contains 110 security requirements across 14 families, including access control, incident response, media protection, and system and communications protection. DoD contracts currently reference Rev 2, even though NIST has published Rev 3.
- CMMC 2.0 verifies the controls. The program rule, 32 CFR Part 170, took effect December 16, 2024. The acquisition rule that places CMMC requirements into contracts took effect November 10, 2025.
CMMC is being phased in over three years. Phase 1 began November 10, 2025, with Level 1 and Level 2 self-assessments. Phase 2 begins November 10, 2026, when certain contracts will require Level 2 certification by a Certified Third-Party Assessor Organization (C3PAO). That is about a month from now.
Your SPRS score is the number the DoD sees. A perfect NIST SP 800-171 score is 110, and the lowest possible score is -203.
Includes a 1-on-1 assessment with an ECF Data compliance architect—no obligation, pure clarity.
Where Can CUI Legally Live? Your Options Compared
CUI can live in any environment that meets NIST SP 800-171 and, for cloud services, the DFARS 7012 cloud provision. Under that provision, the provider must meet FedRAMP Moderate baseline equivalency and accept the clause’s incident-reporting and access obligations. Meeting that bar varies a lot by platform.
Option | Where it fits | Main trade-off |
On-premises | Small, tightly scoped programs with in-house security staff | You own and must evidence every control |
Commercial Microsoft 365 | Generally not recommended for CUI | No commitment to US-person support or US-only data handling for export-controlled data |
Microsoft 365 GCC | Some CUI without ITAR or export-control requirements | Limits for export-controlled data; confirm with your prime and contracting officer |
Microsoft 365 GCC High | CUI, ITAR, and export-controlled data | Separate tenant, higher licensing cost, migration effort |
Microsoft 365 DoD | Direct DoD customers and higher-sensitivity workloads | Eligibility limits; built for DoD entities |
Azure Government | CUI workloads beyond Microsoft 365: applications, infrastructure, data platforms | Requires architecture and operations skills |
Third-party enclave | Small teams that need to isolate CUI quickly | Vendor dependency; scope and data movement need careful design |
Evaluate each option against six criteria:
- FedRAMP authorization level
- Data residency
- US-person administration and support
- Export-control (ITAR/EAR) fit
- Total cost
- Operational complexity
Choose GCC High if your contract involves ITAR, controlled technical information, or a prime that requires it.
Choose an enclave if only a small group handles CUI and the rest of the business should stay on its current systems.
Is Microsoft 365 Commercial or GCC Good Enough for CUI?
For most defense contractors, no. Microsoft’s own guidance points contractors with ITAR or other export-controlled data to GCC High, because commercial Microsoft 365 and GCC are not designed around the US-person support and US-sovereign handling those regimes expect.
The reasons come down to three points:
- FedRAMP Moderate equivalency is a floor, not a finish line. A December 21, 2023 DoD CIO memorandum requires that equivalency be demonstrated against 100% of the FedRAMP Moderate baseline, assessed by a FedRAMP-recognized third-party assessor.
- Export controls raise the bar. ITAR (22 CFR Parts 120–130) restricts access by non-US persons, including administrators and support staff. Many commercial services cannot commit to that.
- Incident obligations travel with the data. DFARS 7012 requires a 72-hour report and image preservation. Your provider must be able to support that process.
GCC can be defensible for CUI that carries no export-control requirement. Confirm this with your contracting officer and prime before you commit. If you guess wrong, you may need to migrate twice.
When Do You Need GCC High, DoD, or Azure Government?
You need GCC High when your CUI includes export-controlled data, controlled technical information, or a customer expectation of a sovereign environment. It is the most common landing zone for defense industrial base contractors.
These platforms map to DoD Cloud Computing Security Requirements Guide (SRG) impact levels:
- Microsoft 365 GCC High is built on FedRAMP High controls and meets DoD SRG Impact Level 4.
- Microsoft 365 DoD meets Impact Level 5 and serves DoD entities directly.
- Azure Government is FedRAMP High authorized and supports Impact Level 4, with Impact Level 5 available for many services. Impact Level 6 applies to classified workloads in separate Azure Government Secret regions, not to standard CUI.
Three practical facts matter:
- GCC High is a separate tenant. It has its own Entra ID, its own portal at the .us domain, and no in-place upgrade from commercial. Every user and workload must be migrated.
- Eligibility is verified. Microsoft validates that the organization handles data that justifies GCC High before provisioning.
- Azure Government extends beyond email and files. Use it for engineering applications, data platforms, and legacy workloads that must also hold CUI.
What Are the Most Common Mistakes Contractors Make With CUI?
The most common mistake is assuming existing IT is “good enough” and moving CUI in before scoping the environment. The cost of errors is real. The DOJ Civil Cyber-Fraud Initiative, launched October 6, 2021, has produced multi-million-dollar False Claims Act settlements, including Aerojet Rocketdyne at $9 million in 2022 and MORSECORP at $4.6 million in 2025.
Seven mistakes show up repeatedly:
- Storing CUI in a commercial tenant.
Fix: Provision a compliant environment first, then migrate. - Over-scoping the enclave.
Fix: Limit CUI to the smallest set of users, systems, and data that need it. - Forgetting email, Teams, and chat.
Fix: Treat every communication channel as a CUI path. - Allowing unmanaged or personal devices.
Fix: Enforce device compliance and conditional access. - Skipping encryption standards. NIST SP 800-171 requirement 3.13.11 calls for FIPS-validated cryptography.
Fix: Verify validation certificates, not marketing claims. - Neglecting backup and recovery. Requirement 3.8.9 requires protecting the confidentiality of backup CUI.
Fix: Keep backups inside the compliant boundary. - Treating compliance as a one-time project. CMMC certifications last three years and require annual affirmations.
Fix: Budget for ongoing monitoring and evidence collection.
How Do You Migrate to a CUI-Compliant Cloud Without Disrupting Work?
Migrate in phases, scope tightly, and keep production running while the new environment is built and validated. A well-planned move rarely requires a full stop in operations.
A reliable sequence looks like this:
- Scope and classify. Confirm what is CUI and who needs access.
- Design the architecture. Define identity, network, logging, and data boundaries.
- Stand up the tenant. Configure Entra ID, conditional access, multifactor authentication, and device compliance.
- Migrate in waves. Move pilot users and low-risk data first.
- Validate against NIST SP 800-171. Update your System Security Plan and POA&M.
- Operate and monitor. Add continuous monitoring, log review, patching, and incident response.
Supporting services matter as much as the tenant. CUI environments need network management, remote monitoring, and secure backup and recovery that all stay within the compliance boundary. A strong migration plan also decides early whether to move the whole company or build a focused enclave, since that choice drives cost and timeline more than any other.
Why Does an AOS-G Partner Matter for Government Cloud Projects?
An AOS-G partner is authorized by Microsoft to deliver licensing and services into government cloud environments, and few partners hold that authorization. For CUI work, it means your partner can legitimately provision, license, and support GCC High, DoD, and Azure Government rather than reselling or advising from the outside.
ECF Data is an authorized Microsoft Partner and one of the select group of AOS-G (Agreement for Online Services – Government) partners. Its work covers:
- Licensing, migrations, architecture, and managed support for U.S. public sector entities, DoD contractors, and supporting agencies
- Microsoft government clouds, including Azure Government and Microsoft 365 GCC High and DoD environments, aligned to FedRAMP High and DoD SRG requirements
- Complex legacy migrations into secure, sovereign cloud infrastructure
- Network management, remote monitoring, and secure data backup and recovery
Before you hire any partner for CUI work, ask these questions:
- Which government cloud authorizations and licensing channels do you hold?
- Have you completed GCC High or DoD migrations for defense contractors?
- Are your administrators US persons, and who has access to our tenant?
- How do you support CMMC evidence collection and C3PAO assessments?
- What is your managed support model after go-live?
Don’t Wait for an Audit Failure or Security Blind Spot
Whether you need help navigating GCC High, optimizing your Microsoft 365 licenses, or securing your data boundaries, our team is ready to help.
