GCC High vs a CUI Enclave: What Should a Small Defense Contractor Buy?

By: David Dillow, CTO, Greypike Inc.
Last updated: October 31, 2026

“Do we have to move everything to GCC High?”

I get that question from almost every small defense contractor that handles CUI. Usually it comes right after someone quoted them a full migration of every mailbox, every file share and every laptop in the company.

Sometimes that’s the right answer. Often it isn’t. In my 20+ year government career I was always taught, never assume anything, and the biggest assumption I see here is that every person in the company needs to be inside the most expensive cloud.

BLUF

CMMC does not require GCC High by name. DFARS 252.204-7012 requires cloud services that store or process CUI to meet the FedRAMP Moderate baseline or equivalent, and Microsoft points defense contractors that handle CUI toward GCC High. If only a handful of your people touch CUI, a CUI enclave (a separate, locked-down workspace for just those people) is usually faster, less disruptive and cheaper than moving the whole company. If most of your staff touch CUI or export-controlled data every day, a full GCC High migration may make more sense.

Key takeaways

• CMMC is about protecting CUI, not about buying one specific product.
• Count the people who actually touch CUI. That number drives the decision.
• An enclave shrinks your assessment scope, because fewer systems handle CUI.
• GCC High requires Microsoft eligibility validation and a purchase through an authorized reseller. Plan for weeks, not days.
• Either way, the environment still has to be documented and checked continuously.

What is GCC High, and does CMMC require it?

GCC High is Microsoft 365 for the defense industrial base and government. It’s a separate cloud built for CUI and export-controlled data, with U.S.-based infrastructure and tighter access controls than commercial Microsoft 365.

CMMC itself doesn’t name GCC High. What it requires is that you protect CUI using the 110 requirements in NIST SP 800-171. Separately, DFARS 252.204-7012 says any cloud service that stores or processes your CUI must meet the FedRAMP Moderate baseline or equivalent. Microsoft’s guidance steers contractors that handle CUI to GCC High, and that’s why so many people treat the two as the same thing.

For a deeper comparison of the Microsoft clouds, see our knowledge base article on Microsoft 365 GCC vs GCC High for CMMC.

What is a CUI enclave?

An enclave is a separate, locked-down place to work with CUI. Only the people who need CUI get access. Everyone else keeps using the normal company email and files.

Think of it like a secure room inside your building. You don’t have to put a vault door on every office. You put one on the room where the sensitive work happens, and you control who goes in.

Because CUI stays inside the enclave, the rest of your company has much less to prove in an assessment. That’s the biggest reason enclaves save money: scope drives cost.

GCC High migration vs CUI enclave: side by side

	Full GCC High migration	CUI enclave
Who moves	Everyone in the company	Only the people who touch CUI
Disruption	High. Mailboxes, files, devices and apps all move.	Low. Most staff see no change.
Assessment scope	Whole company	The enclave and the systems that protect it
Licensing	GCC High licenses for every user	Licenses only for enclave users
Best fit	Most staff handle CUI or export-controlled data daily	A small group, like engineers or contracts staff, handles CUI
Watch out for	Longer timeline and a bigger licensing bill	CUI leaking outside the enclave by email or USB if rules aren’t enforced

How do you buy GCC High?

You can’t just add GCC High licenses to a credit card. The usual steps are:

1. Apply to Microsoft for eligibility validation. You may need proof such as a DoD contract, a sponsor letter, or your CAGE code and SAM registration.
2. Wait for approval. Validation alone can take up to about two weeks.
3. Buy licenses through an authorized Microsoft government reseller.
4. Build and configure the tenant, then move users and data. Depending on size, that can take several weeks to several months.

Start early, well before a contract with CUI needs it.

What does a CUI enclave cost?

Here is how we price ours, straight from our pricing page:

• $295 per user, per month, for only the people who touch CUI, with lower rates from 11 users
• $4,500 one-time setup
• Built in your own GCC High tenant, so you own it
• Microsoft licenses passed through to you at cost, or bring your own
• Runs alongside our Compliance App ($399 a month), because the enclave has to be documented and checked continuously

Here’s an example. A 40-person manufacturer has six engineers who work with CUI drawings. Everyone else never touches it.

• Enclave: 6 users x $295 = $1,770 a month
• Compliance App: $399 a month
• Total: $2,169 a month, plus $4,500 one-time setup and Microsoft licenses for the six enclave users

The other 34 people stay where they are. That’s the whole point.

Are there other GCC High alternatives?

Yes. Some companies use secure file-sharing and email products built for CUI, and some use enclaves built on Azure Government. Each has trade-offs in what it covers and how it fits your other tools. We compare one common option in PreVeil vs GCC High.

Whatever you pick, ask the vendor three things: Does it meet FedRAMP Moderate or equivalent for CUI? Who owns the tenant and the data? And how will you prove to an assessor that CUI stays inside it?

How do I decide in 10 minutes?

1. Count the people who touch CUI. If it’s a small group, start by looking at an enclave.
2. Ask whether you handle ITAR or EAR export-controlled data. If yes, confirm your cloud supports it before anything else.
3. List where CUI lives today: email, file shares, laptops, USB drives, your ERP. That list is your scope.
4. Price both options for 12 months, including setup and licenses.

If you already have a GCC High migration quote, send it to us and we’ll tell you whether an enclave would do the job for less. It’s worth getting ahead of this before your next contract with CUI lands on your desk.

Frequently asked questions

Does CMMC require GCC High?

No. CMMC requires you to protect CUI using NIST SP 800-171. DFARS 252.204-7012 requires cloud services that store or process CUI to meet the FedRAMP Moderate baseline or equivalent. Microsoft steers contractors that handle CUI to GCC High, but a CUI enclave can be a valid way to meet the requirement.

What is the difference between GCC and GCC High?

Both are Microsoft government clouds. GCC High is built for CUI and export-controlled data and has stricter access controls. GCC is often used for less sensitive government work. Read our knowledge base comparison for the details.

How much does a CUI enclave cost?

Greypike’s enclave is $295 per user per month for only the people who touch CUI, with lower rates from 11 users, plus a $4,500 one-time setup. Microsoft licenses are passed through at cost, and the enclave runs alongside the $399 a month Compliance App.

How long does it take to get GCC High?

Microsoft eligibility validation can take up to about two weeks. Building the tenant and moving users and data can take several weeks to several months, depending on your size.

Does a CUI enclave reduce my CMMC assessment scope?

Yes. When CUI stays inside the enclave, the systems that handle CUI are limited to the enclave and the tools that protect it. The rest of your company has far less to prove.

Who should do a full GCC High migration instead of an enclave?

Companies where most staff handle CUI or export-controlled data every day. If CUI is everywhere in your business, walling it off in an enclave can be harder than moving everyone.