Do You Need GCC High for CMMC 2.0?
NO! You do not need GCC High for CMMC 2.0, not even for level 3. However, you might need GCC High for other reasons. See the reasons you might need GCC High below.
GCC High is not required to meet CMMC at any level. However, GCC High is the only version of the Office 365 or Microsoft 365 platform that meets the reporting requirements of DFARS 7012 found in paragraphs C-G. Technically, the Commercial and GCC versions of the platform can be configured to meet NIST 800-171, and the vast majority of CMMC’s requirements with native security products/capabilities. CMMC Level 3, for example, can be met in Commercial and GCC per the standards written to date.
if you have DFARS 7012 requirements in your contracts, then you need GCC High
You will need GCC High if you manage, create, or hold any of the following types of information
- Export Controlled CUI
- International Traffic in Arms Regulations (ITAR)
- Export Administration Regulations (EAR)
- Specified CUI that requires US Sovereignty
- Controlled Defense Information
- Nuclear Information (FERC/NERC)
- NASA
- CUI marked NOFORN
- Criminal Justice Information Systems (Federal)
This is not the complete list of information types that require GCC High however, having these information types will always require GCC High.