Compliance / Sub-service 04
GCC High migration consultant.
Ready before the CMMC pause ends.
Defense contractors handling Controlled Unclassified Information need Microsoft 365 GCC High with documented controls — a requirement CMMC Phase 2's suspension paused but did not remove, since DFARS 252.204-7012 and your NIST 800-171 self-attestation still bind. We move you, configure the tenant for CUI handling, and document the controls for the eventual C3PAO assessor — System Security Plan, Plan of Action & Milestones, and the NIST 800-171 control evidence.
CMMC Phase 2 — the Nov 10, 2026 milestone — was suspended July 13, 2026; DFARS 252.204-7012 and NIST 800-171 self-attestation still bind. GCC High implementations typically take 6–12 months for 100–500 users.
Service detail
GCC High migration timeline for CMMC Level 2
Realistic timeline for an unprepared 100–500-user defense contractor: 6–12 months from kickoff to CMMC Phase 2 readiness. The technical migration is half the work — the System Security Plan and POA&M are the deliverables the C3PAO actually reviews.
What's in scope
- ›GCC High tenant provisioning and licensing
- ›Identity migration from commercial to GCC High
- ›CUI-safe SharePoint, Teams, and Exchange configuration
- ›Conditional Access policies aligned to NIST 800-171
- ›Microsoft Purview labeling for CUI handling
- ›Endpoint baseline (Intune + Defender) with FIPS-validated cryptography
- ›Audit log retention sized to CMMC requirements
- ›Documentation package for CMMC L2 / L3 assessment
Compliance frameworks we map to
- ›CMMC Level 1 — Foundational (15 practices)
- ›CMMC Level 2 — Advanced (110 practices, NIST 800-171 r2)
- ›CMMC Level 3 — Expert (NIST 800-172, defense priorities)
- ›DFARS 252.204-7012 — Safeguarding Covered Defense Information
- ›NIST 800-171 / 800-172 — handling Controlled Unclassified Information
- ›ITAR-aware configurations where required
What you get
- ›GCC High target architecture documented and reviewed
- ›Migration runbook with parallel-run validation
- ›System Security Plan (SSP) starter package mapped to CMMC controls
- ›Plan of Action & Milestones (POA&M) for residual gaps
- ›Two weeks of hypercare with assessor-question support
- ›Optional ongoing compliance management via our managed-support lane
FAQ
Common questions about GCC High and CMMC.
What does a GCC High migration consultant do for defense contractors?
A GCC High migration consultant moves a defense contractor from a commercial Microsoft 365 tenant to Microsoft 365 GCC High — the FedRAMP High and DFARS-compliant cloud environment required for handling Controlled Unclassified Information (CUI). Scope: GCC High tenant provisioning, identity migration (Entra ID), mailbox and SharePoint migration, CUI-safe configuration, NIST 800-171 control mapping across all 110 controls, gap remediation, System Security Plan (SSP) authoring, Plan of Action & Milestones (POA&M), incident response procedures, training records, and the artifacts a C3PAO assessor reviews for CMMC Level 2 certification. Realistic timeline: 6-12 months from kickoff to CMMC Phase 2 readiness for a 100-500 user contractor.
When does CMMC Phase 2 enforcement start?
It doesn't start on a set date any more. The Department of War suspended CMMC Phase 2 on July 13, 2026 — the milestone scheduled for November 10, 2026 — and paused Phases 3 and 4 behind it. What did not change: DFARS 252.204-7012 still binds, and NIST 800-171 self-attestation via your SPRS score is still a contractual obligation. With the third-party assessment gate removed, an inflated SPRS score is a larger False Claims Act exposure than it was before. A public RFI closes August 14, 2026 and a reform task force is due to report within 60 days of the July 13 memo; treat any replacement date as unset until then. Historically, Phase 2 affects most subcontractors handling DoD information; Phase 3 (Level 3, expert) and Phase 4 (full enforcement) follow on a phased schedule.
Does CMMC require GCC High?
Not strictly required by the regulation, but practically required for most defense contractors handling CUI. Microsoft 365 GCC High provides the FedRAMP High and DFARS-compliant cloud environment that lets you handle CUI without building custom controls. Some contractors using GCC (Government Community Cloud) can meet Level 2; CUI handling at scale almost always requires GCC High.
How long does GCC High migration take?
Realistic timeline for an unprepared 100–500 user defense contractor: 6–12 months from kickoff to CMMC Phase 2 readiness. The technical migration (3–4 months for that size) is half the work. The other half is policy documentation: System Security Plan, Plan of Action & Milestones, incident response procedures, training records, and the artifacts the C3PAO assessor actually reviews.
What's the difference between GCC, GCC High, and DoD?
Three Microsoft government clouds: GCC (Government Community Cloud) covers most US federal civilian and state/local; GCC High is the DFARS- and ITAR-aware cloud for defense contractors handling CUI; DoD is the highest-classification cloud, accessible only to DoD itself and select contractors. Defense contractors handling CUI at scale almost always need GCC High.
Do you write the System Security Plan?
We write the SSP starter package mapped to your CMMC controls — the technical configuration, the policy statements that map to NIST 800-171 controls, and the POA&M for any residual gaps. Final SSP ownership stays with the customer's compliance program; we provide the engineered baseline that makes it auditable.
Field notes
- → GCC High before CMMC Phase 2 — what still binds with Phase 2 suspended, realistic timelines, common mistakes.
Where are you in the CMMC roadmap?
Tell us your seat count, contract types, and target assessment date. Two-business-day response with scope and timeline.