Microsoft 365 GCC High is one of the biggest real costs of getting ready for CMMC. Some defense contractors need it. Others are told they need it when a different Microsoft cloud would meet their requirements. The deciding factor is the data you handle, not the size of your company.

What the rule requires of your cloud

DFARS 252.204-7012(b)(2)(ii)(D) says that if you use an external cloud service provider to store, process or transmit covered defense information, you must require and ensure that the provider:

Meets security requirements equivalent to the FedRAMP Moderate baseline- Complies with paragraphs (c) through (g) of the clause: cyber incident reporting, malicious software, media preservation and protection, access for forensic analysis, and cyber incident damage assessmentThose paragraphs include reporting within 72 hours of discovery and preserving images of affected systems for at least 90 days.…