As more organizations move their data and applications to the cloud, it is important to ensure that they comply with regulatory requirements. In particular, organizations that deal with sensitive data subject to the International Traffic in Arms Regulations (ITAR) must take extra precautions to ensure that their data is secure and that they comply with all ITAR requirements. Microsoft GCC High Office 365 is a cloud-based platform that can help organizations achieve ITAR compliance, while also providing numerous benefits for productivity, collaboration, and security.
What is ITAR?
ITAR is a set of US government regulations that control the export and import of defense-related articles, services, and technical data. IT applies to all US companies that manufacture, export, or import defense articles, services, or technical data, as well as to foreign companies that receive or use US-origin defense articles or technical data. ITAR is designed to protect US national security and foreign policy interests by controlling the export of sensitive information, such as military technologies and defense articles, to foreign entities. For more information about ITAR, review our article ITAR Compliance: A Comprehensive GuideWhy is ITAR compliance important?
ITAR compliance is important for several reasons. First, failure to comply with ITAR regulations can result in severe penalties, including fines, imprisonment, and loss of export privileges. Second, ITAR compliance is necessary to protect national security and foreign policy interests. By controlling the export of sensitive information, ITAR helps prevent the proliferation of sensitive military technologies and defense articles to foreign entities and getting into the wrong hands. Finally, ITAR compliance can help organizations establish trust and credibility with their customers, partners, and stakeholders.How does Microsoft Office 365 GCC High help with ITAR compliance?
Microsoft GCC High Office 365 is a cloud-based platform specifically designed for U.S. government organizations and contractors handling sensitive data subject to ITAR and other regulatory requirements. GCC stands for Government Community Cloud, a separate cloud infrastructure isolated from other Office 365 environments and meeting the rigorous security and compliance standards required by U.S. government agencies. Microsoft GCC High Office 365 also supports compliance with various industry and regulatory standards, including ITAR, CMMC 2.0, HIPAA, FERPA, and others. But how does Office 365 GCC High help with ITAR compliance?Physical data isolation and security
ITAR compliance mandates that access to technical data or physical materials related to military and defense technologies be restricted to U.S. persons. Microsoft Office 365 GCC High ensures all customer data is physically isolated within the U.S. The data centers that hold ITAR-controlled data or any other data are physically located within the continental United States. It also limits access to such data to U.S. persons only. Thus, office 365 GCC High provides assurance that sensitive defense-related data is stored securely within the country and cannot be accessed by unauthorized foreign entities.Data encryption
Data encryption is a critical part of ITAR compliance. Technical data should be encrypted with FIPS 140-2 compliant cryptographic modules. It also should be secured using end-to-end encryption in line with 22 CFR 120.54. Microsoft Office 365 GCC High is designed in line with DoD SRG level 4 controls and supports strictly regulated defense and federal information. Office 365 GCC High tenants encrypt data at rest and in transit and uses FIPS 140 validated cryptographic modules. Thus, data can only be accessed when it enters the receiver’s security boundary. Therefore, Office 365 GCC High prevents unauthorized access and export of ITAR-controlled data.Data sovereignty
This refers to the concept of a jurisdiction or country having the right to govern and control data collection, processing, storage, and dissemination within its borders. There are many laws on data sovereignty, one of which is the ITAR. Office 365 GCC High is designed to meet government agencies’ and related organizations’ specific regulatory and compliance requirements. The cloud-based productivity suite doesn’t replicate customer data outside the U.S. and doesn’t allow data transfer to third parties without customer consent. This helps contractors and federal agencies have control and ownership of their data while meeting the ITAR requirement to prevent foreign access or transfer of defense-related data.Data classification
Organizations can use Microsoft Purview Information Protection to discover, classify, safeguard, and control sensitive information in transit or at rest. Using features and products of Microsoft Purview Information Protection, contractors can use sensitivity labels to classify records and documents. Using such tools, Office 365 GCC High enables customers to classify their data according to the sensitivity level and apply appropriate policies and labels. This helps customers identify and manage their ITAR-regulated data and comply with the ITAR requirement to appropriately mark and handle defense-related data.Screening
The ITAR has strict restrictions that require technical data to be only accessed or viewed by authorized U.S. persons. Microsoft Office 365 GCC High meets this requirement by extensively vetting and screening all Microsoft personnel who may access customer data. These checks include education, employment eligibility, and citizenship, among other extensive background checks. Only U.S. persons who pass all the screening and vetting requirements can work on Microsoft GCC High. This screening ensures that only authorized persons, as per ITAR guidelines, have access to technical data supporting ITAR compliance.Information governance and records management
Data governance refers to ensuring data security, quality, availability, and usability throughout its lifecycle. Microsoft 365 Information Governance and Records Management is the tool that Office 365 GCC High provides customers with to help with critical data governance. With Microsoft Information Governance, contractors and government organizations can manage risks by discovering, labeling, classifying, and deleting their data, an essential ITAR compliance requirement. The tool allows agencies and organizations to reduce risk by providing lifecycle management throughout their Microsoft 365 data. Records Management provides contractors and federal agencies the ability to manage content in a manner that helps meet regulatory compliance. Records management helps organizations:- Retain, classify, and manage content based on an organization’s retention schedule without compromising end-user productivity.
- Defensibly dispose of files, including approval and review.
- Show ITAR compliance through defensible audit trails
