-
By: Janina Criador - IT Guides
- Last Updated On: November 3, 2026
- Comments 0
- 12 min read
Before You Request a GCC High Quote: 7 Questions to Scope Your CUI (And Avoid the All-In G5 Tax)
TL;DR:
- GCC High requirements depend on the type of CUI you handle—not your company size.
- Export-controlled CUI (ITAR/EAR) or contracts requiring US-only access point to GCC High.
- Many contractors license only CUI-handling users within an enclave.
- Not everyone needs G5: Business Premium, G3, or G5 may fit, depending on seat count and required controls.
GCC High requirements for Controlled Unclassified Information (CUI) depend on your data, contracts, and access restrictions, not company size. CMMC does not universally require GCC High or Microsoft G5. At ECF Data, we recommend defining your CUI boundary first. Then, we follow with the evaluation of GCC versus GCC High, enclave versus broader migration, and the licenses your users need.
Before you request a GCC High quote, answer one question: What are you trying to protect?
The answer should be more specific than “our government contracts” or “our engineering team.” You need to identify the controlled information, the users, the systems it touches, and the requirements governing its handling.
ECF Data’s recommendation is straightforward: scope first, license second.
That approach separates three decisions that are too often bundled into one purchase:
- Environment: Do your requirements call for GCC, GCC High, or another qualifying architecture?
- Architecture: Can you contain CUI in an enclave, or should you migrate broader business operations?
- Licensing:Which users need Business Premium, Microsoft G3, G5, or additional capabilities?
purchasing GCC High does not, by itself, make an organization CMMC compliant. Microsoft clarifies that compliance also depends on customer configuration, implementation, and operational controls.
GCC High Requirements for CUI: 7 Questions Before You Buy
Here are the seven questions we recommend answering before you buy.
1.What type of CUI does your business handle?
Not all CUI carry the same handling restrictions.
First, identify the actual information your organization receives, creates, stores, and shares. Then, connect that information to the contract requirements, CUI categories, and applicable access restrictions governing it.
Microsoft’s CMMC guidance distinguishes GCC from GCC High partly through sovereignty requirements. It identifies ITAR-regulated information as an example of information unsuitable for GCC and points organizations with those requirements toward GCC High.
Before requesting pricing, document:
- Which customers or prime contractors provide the information.
- Which CUI categories and markings apply.
- Which contracts and flow-downs establish handling obligations.
- Whether export-control or other access restrictions apply
- Where the information enters, moves through, and leaves your business.
Avoid using “ITAR/EAR” as a catch-all label. Have the appropriate contract or export-compliance owner validate the restrictions that apply to your specific information.
What we recommend preparing
Create simple requirements register:
| Information or workflow | Requirement source | Restriction to validate | Systems involved |
| Technical drawings | Contract and handling instructions | CUI category and export restrictions | Email, engineering storage, collaboration |
| Program deliverables | Prime contractor flow-down | Authorized recipients and sharing requirements | SharePoint, Teams, delivery portal |
| Security investigation records | Contract and security procedures | Evidence handling and provider access | Security tools, ticketing, support |
These are discovery examples—not classifications of your organization’s information.
2. What do your contracts require beyond CMMC?
“CMMC required” is not a complete cloud specification. Your contracts may also establish obligations involving DFARS, export controls, incident response, access restrictions, or customer-specific handling requirements.
For example, DFARS 252.204-7012 requires an external cloud provider storing, processing, or transmitting covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. It also requires the provider to comply with applicable incident-reporting, preservation, and investigative-support provisions. The clause does not universally require a product named GCC High or G5.
| Question | GCC | GCC High |
| Does Microsoft position it to support government compliance requirements? | Yes, including DFARS and FedRAMP High | Yes, including elevated defense and sovereignty requirements |
| Is it appropriate for the ITAR-restricted information described in Microsoft’s CMMC guidance? | Microsoft identifies GCC as unsuitable for that example | Microsoft directs those requirements toward GCC High |
| Does purchasing it establish CMMC compliance? | No | No |
| What must you validate? | Data suitability, contract obligations, service coverage, and implementation | Those same factors, plus eligibility and the required GCC High architecture |
Microsoft’s guidance supports these distinctions, but your specific requirements still determine which environment is appropriate.
At ECF Data, we recommend asking for a documented explanation of the environment choice. Do not settle with a statement that “defense contractors need GCC High.”
3. Who and what belongs inside your CUI boundary?
Your CUI boundary extends beyond the employees who open controlled files.
CMMC scoping rules include assets that process, store, or transmit CUI. They also address Security Protection Assets: systems providing security functions to the assessed environment.
Map both the business workflow and its supporting infrastructure:
- Employees handling controlled information
- Email accounts receiving CUI
- Devices accessing or processing it
- SharePoint sites, Teams workspaces, and document repositories
- Identity and access-management systems
- Endpoint management and security-monitoring tools
- Backup and recovery services
- Administrative accounts and external support providers
An administrator may never read a controlled drawing but still manage a system essential to protecting it.
“We do not put CUI there” is not enough
CMMC distinguishes Contractor Risk Managed Assets from Out-of-Scope Assets. Systems that can handle CUI but are not intended to do so under documented policies are not automatically equivalent to systems that cannot handle CUI and do not protect CUI Assets.
A policy alone does not establish technical separation.
Before quoting licenses, we recommend building three foundational documents:
- An asset inventory.
- A data-flow diagram.
- A proposed assessment boundary.
Together, these provide a more defensible starting point than an employee list.
4. Should you use a GCC High enclave or an all-in migration?
An enclave separates controlled workflows from the rest of your business environment. An all-in approach moves broader business workload into GCC High.
Neither approach is automatically the better investment.
Microsoft recognizes that enclaves can help manage costs, but it also warns about controlled information spilling into email and personal storage outside the intended boundary.
Our recommendation is to test the architecture against how your employees work. This is a decision framework—not a promise that an enclave will always cost less.
Test everyday workflows before committing
Ask what happens when:
- A customer emails CUI to a general business mailbox
- An engineer downloads a controlled drawing
- A project manager copies technical information into a chat
- A support technician requests a screenshot
- A backup service copies controlled files outside the enclave
If those actions bypass your proposed boundary, the design needs revision.
Support deserves particular attention. Microsoft states that GCC High support is outside the service’s accreditation boundary and advises customers to verify authorization before sharing controlled information with agents.
The boundary must be held during ordinary work, not just on an architecture diagram.
5. Do your users need Business Premium, G3, or G5?
Not every employee needs G5 simply because your organization pursues CMMC.
The right license depends on the capabilities required by your security architecture and the licensing terms governing their use. Microsoft positions G3 and G5 differently, with G5 offering additional advanced capabilities; neither subscription independently establishes compliance.
Compare the plans against your control design
| Plan | When to evaluate it | What to confirm |
| Microsoft 365 Business Premium for GCC High | Your eligible organization falls within the offering’s size limit and needs an integrated productivity and security package | Included services, required controls, add-ons, and government-cloud feature availability |
| Microsoft 365 G3 | You need an enterprise-oriented foundation aligned with your architecture | Whether included capabilities and additional tools cover the implementation |
| Microsoft 365 G5 | Your design requires its additional advanced capabilities | Which users need entitlement, which features are available, and whether the bundle replaces other purchases |
Microsoft currently lists Business Premium for GCC High for eligible organizations with up to 500 users. Its government comparison describes G3 and G5 as supporting organizations of any size.
Do not apply commercial Business Premium limits automatically
The commercial and GCC High offerings have different published user limits.
Microsoft’s commercial business plans support a maximum of 300 users, while its government plan comparison lists Business Premium for GCC High for organizations with up to 500 users. Confirm the applicable offer and current terms when requesting your quote.
Ask for a role-based license matrix
We recommend documenting:
- The user group
- The work performed
- The security and compliance capabilities required
- The proposed base license and add-ons
- The licensing basis for features benefiting multiple users
- Any additional security products
Do not assume that assigning one advanced license to an administrator authorizes organization-wide use of every associated capability. Ask the provider to document the applicable entitlement requirements.
Also request complete product names. Microsoft lists Office 365 G3 and Microsoft 365 G3 separately; “G3” alone does not describe a sufficiently precise purchase.
What will each option cost to operate?
The “all-in G5 tax” is not a Microsoft fee. It describes the avoidable cost of buying a broader deployment and higher license tier before validating the need.
G5 can be the right choice. An all-in migration can also be the right choice. The issue is whether the architecture and capabilities justify the expense.
At ECF Data, we recommend comparing complete operating models, not just per-user subscription prices.
Include:
- Base licenses and add-ons
- Migration and configuration
- Endpoint management and protection
- Backup and recovery
- Security monitoring and response
- Administration
- User training
- Evidence collection and maintenance
- Any duplicate services required by an enclave
Example: 100 employees, 20 CUI users
Consider a hypothetical contractor with 100 employees and 20 regular CUI users.
Rather than immediately requesting 100 G5 licenses, or assuming exactly 20 licenses will suffice, compare two designs:
- A separated enclave supporting controlled workflows and their administrative and security dependencies.
- A broader GCC High migration with licenses selected according to required capabilities.
Twenty CUI users do not automatically translate into only 20 assets in assessment scope. Relevant Security Protection Assets must also be evaluated.
Likewise, migrating 100 employees does not establish a need for 100 G5 licenses.
The useful comparison is whether the enclave’s smaller licensing footprint outweighs its isolation, duplicate-service, and operating requirements. Any claimed savings should come from a documented, like-for-like estimate.
7. Who owns the controls after deployment?
A successful migration is not the same as a sustainable compliance program.
Microsoft states that customer configuration, implementation, and operational controls remain essential to CMMC compliance. It also states that it does not certify or endorse partner offerings for CMMC compliance outcomes.
Before signing a quote, establish ownership for:
- Identity and access administration
- Endpoint configuration and maintenance
- Security alert investigation
- External sharing approvals
- System Security Plan updates
- Asset inventory maintenance
- Evidence retention
- Incident reporting and recovery
- Periodic boundary reviews
Ask for a responsibility matrix showing what Microsoft provides, what your service provider performs, and what remains with your team.
Eligibility also belongs in the implementation plan. Microsoft requires eligible GCC High customers to complete validation before an environment is established, and GCC High trials are not available.
Your quote should explain the path from eligibility and deployment to ongoing operation—not stop at license provisioning.
What to prepare before requesting an ECF Data quote
You do not need every architecture decision finalized before starting a conversation. You do need enough information to make the quote meaningful.
Bring the following:
- CUI information: Categories, sources, markings, and handling requirements.
- Contract requirements: Applicable clauses, flow-downs, and customer instructions.
- User roles: CUI handlers, administrators, and external collaborators.
- Current systems: Email, storage, endpoints, security tools, and backup services.
- Workflow examples: How controlled information enters, moves through, and leaves your business.
- Architecture preferences: Enclave, broader migration, or an evaluation of both.
- Operational responsibilities: What your team manages and where outside support is needed.
A useful proposal should connect the architecture, licenses, assumptions, and responsibilities.
Start with your CUI boundary, not an all-in G5 order
Before requesting pricing from ECF Data, document what information you handle, who needs access, and which controls your environment must support.
Use that scope to evaluate GCC versus GCC High, compare an enclave with a broader migration, and select Business Premium, G3, or G5 based on a documented need.
Request an ECF Data consultation to discuss your CUI requirements and GCC High licensing options.
Frequently asked questions
Does CMMC require GCC High?
CMMC does not universally mandate GCC High. Microsoft positions GCC High to support CMMC Level 2 and Level 3 efforts when appropriately configured, particularly where demanding defense or sovereignty requirements apply; suitability depends on your data, contracts, architecture, and implementation.
Can GCC handle CUI, or do we need GCC High?
The answer depends on the specific information and its restrictions. Microsoft identifies GCC as supporting DFARS and FedRAMP High but says it is unsuitable for certain restricted information, including the ITAR example in its CMMC guidance.
Does everyone need G5 for CMMC?
No. CMMC compliance depends on implemented controls and operations, not a universal G5 licensing requirement. Evaluate the capabilities each user needs and verify the licensing terms for the proposed implementation.
Is Microsoft 365 Business Premium available for GCC High?
Yes. Microsoft currently lists Business Premium for GCC High for eligible organizations with up to 500 users. Verify the current offering, included capabilities, and terms when requesting a quote.
Can we move only our CUI team into GCC High?
An enclave can separate selected controlled workflows from the rest of the business, but it must prevent CUI from spilling into other systems. Microsoft recognizes enclave cost-management opportunities while warning about spillage, and CMMC scoping also requires evaluation of relevant security-protection systems.
