Does CMMC Require GCC High? Microsoft 365 Options Compared

By Shaheer Malik · Updated Oct 28, 2026

No. CMMC does not require GCC High by name. It requires that a cloud service provider storing, processing or transmitting your CUI meet the FedRAMP Moderate requirements in DFARS 252.204-7012. Microsoft 365 GCC is FedRAMP Moderate authorized and GCC High is FedRAMP High authorized, so both clear that bar for CUI; export-controlled data and contract terms decide between them.^[1][2][3][4]

What the rule actually says

When a cloud provider handles CUI, “the CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012.”^[1] That clause requires the provider to meet “security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline” and to comply with its incident reporting, malware, media preservation, forensic access and damage assessment paragraphs, (c) through (g).^[2]

The three Microsoft 365 options

Listings from the FedRAMP Marketplace.^[3][4][5]

When export control decides

If you handle ITAR technical data, letting a foreign person access unencrypted technical data counts as a release and can be an export.^[6] The question then is not only FedRAMP level but who at the provider can reach your data. Ask the provider in writing how it restricts access and where data is stored. See CMMC and ITAR.

Level 1 doesn’t need a government cloud

The FedRAMP requirement applies to providers handling CUI. For FCI only, the rule sets no cloud authorization requirement; what matters is meeting the 15 Level 1 requirements in the service you use.^[1]

Cutting the cost

You don’t have to move everyone. Keeping CUI in a smaller environment for just the people who handle it, an enclave, shrinks both licences and assessment scope. And Macs can be in scope like any endpoint: they must meet the same requirements as Windows devices that touch CUI.^[1]

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

Is GCC High required for CMMC Level 2?

No. The rule requires FedRAMP Moderate or equivalent for cloud providers holding CUI. GCC (Moderate) and GCC High (High) both meet that bar; export-controlled data and contract terms usually decide.

Can I use commercial Microsoft 365 for CMMC?

For Level 1 (FCI only), yes, if configured to meet the 15 requirements. For CUI, the provider must meet FedRAMP Moderate or equivalent, which the commercial suite is not listed as on the FedRAMP Marketplace.

Can a Mac be CMMC compliant with GCC High?

Devices are not “compliant” on their own. A Mac that accesses CUI is in your assessment scope and must meet the same requirements as any other in-scope endpoint.

Sources

1. 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
2. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
3. FedRAMP Marketplace: Microsoft 365 Government Community Cloud & Supporting Services (Moderate) (checked Oct 28, 2026)
4. FedRAMP Marketplace: Microsoft 365 Government Community Cloud-High (High) (checked Oct 28, 2026)
5. FedRAMP Marketplace data, published by GSA (last changed May 19, 2026) (checked Oct 28, 2026)
6. 22 CFR part 120, International Traffic in Arms Regulations: purpose and definitions (checked Oct 28, 2026)

More on cloud, tools and enclaves

• Google Workspace and CMMC: Level 1, Level 2 and Editions
• Is Box, Dropbox, HubSpot or ChatGPT CMMC Compliant?
• CMMC Enclave: What It Is, When You Need One, What It Costs
• CMMC Compliance Software: What It Can and Can’t Do