GCC High Validation

Industry:, , ,

If you’re a DoD contractor or have your sights set on becoming one, you most likely have heard of GCC High. But what is it? GCC High is a short form for Government Community Cloud High. It is a Microsoft 365 service offering designed to meet cybersecurity and compliance requirements for cleared personnel and organizations supporting the DoD. This secure enclave is built within Azure Government and hosted on geographically isolated data centers located within the United States. Thus, all data resides in US data centers, supported by US persons who have undergone and passed thorough background checks. Because of this, GCC High is suitable for ITAR data.   

The offering is also rated at DISA SRG IL 5, meaning it can house CUI corporately and on behalf of the Government. Being FedRAMP High equivalent, this service offering can be used to achieve CMMC 2.0 compliance at all levels. If you are here, you either have decided or are planning to move into GCC High tenant and are wondering, what is the process? Accessing Microsoft GCC High tenants requires validation directly from Microsoft. This article will delve into the process of validation—but before that — Licensing.  

Microsoft GCC High Licensing

We are a Microsoft Partner and have extensive experience helping organizations purchase and implement Microsoft cloud services. We can; 

  • Help you choose the right licensing option for your needs.
  • Provide you with with a Microsoft GCC High licensing quote.
  • Assist you navigate the complex purchasing process. 
  • Provide you with ongoing support after you purchase your licenses. 

Below are some of the things you should understand about Microsoft Office 365 GCC High Licensing:   

Annual Contract  

Although pricing is defined monthly, you purchase the service offering on an annual contract. During your subscription term, you can add an extra license depending on your needs. However, that will result in a prorated charge for the remaining months. Your initial purchase sets the price for both that product and any additional products you choose within the same subscription term.  

Availability  

Office 365 GCC high includes most of the products and feature sets available in GCC and some commercial clouds such as Exchange Online, OneDrive, Teams, SharePoint, Etc. However, not all the Power Platform functionalities, Defender features, and Microsoft 365 services are on the Microsoft 365 GCC High pricing list. Your OAS-G partner or LSP should provide you with information on the features or products included in the pricing list. In case of changes in pricing, they should inform you beforehand.  

Licensing Costs  

Compared to commercial/GCC offerings, GCC High costs much more. Additionally, you’ll need to pay upfront for the full year. This is primarily because of the enhanced security features, dedicated US data centers, and screened US personnel that contribute to overall stricter compliance. However, the cost depends on the specific license, and its price may change monthly. While the upfront price might seem higher, GCC High delivers long-term benefits like improved data protection, peace of mind from meeting crucial regulations, and potentially lower risks from cyberattacks.    

License Names  

Microsoft documentation refers to products in GCC High using differing naming patterns. For instance, Microsoft 365 G3 is GCC High and equivalent to Microsoft 365 E3. While user-friendly names in products may remain consistent, the underlying SKUs in GCC High can differ significantly. As an example, M365 G3 licensing options include:  

  • M365 G3 Unified CAO GCCH Sub User CCAL w/OPP,   
  • M365 G3 Original CAO GCCH Sub User CCAL w/OPP  
  • M365 G3 Original GCCH Sub Per User,   
  • M365 G5 FUSL GCCH Sub Per User, and  
  • M365 G3 Unified GCCH Sub Per User.  

Your purchase invoice may show a license name like Microsoft 365 G3, but after activating your GCC High tenant, the portal product names may look completely different. This difference in portal versus invoice naming can be confusing but does not mean something is amiss.  

Validating Your Organization With Microsoft

So, what are the steps your organization must go through to qualify for GCC High? To purchase GCC High, any organization must first receive a Microsoft validation. This process has 3 main steps;  

  1. Selecting the category and validation or service needed 
  2. Providing required documentation or information  
  3. Submitting the validation request  

Each step is explained in detail below;  

Selecting the Category and Validation or Service You Need  

Selecting Category  

The validation process starts when your organization fills out the Government Community Cloud Eligibility Intake Form. This form aims at helping Microsoft verify your organization’s eligibility as either one of the following 3 categories:  

  • US federal, state, local, or Tribal Government entity
  • Solution provider serving US federal, state, local or Tribal Government entities: This option applies to Microsoft partners such as CSPs. They use it when looking to qualify for programs that need Government Validation.  
  • Customers handling Government-controlled data: If you aren’t a government entity, select this option. Selecting “Solution provider serving US federal, state, local or Tribal Government entities,” your validation request will be declined. This is the only option for non-governmental entities holding government-controlled data to attain GCC High validation.  

When applying for a Microsoft GCC High, you must be validated as a category 3 entity. If validated at category 2, you can only qualify for GCC, NOT M365 GCC High. After Microsoft reviews your request for validation, they will reach out via email within 2 business days regarding the next steps.  

Selecting Validation or Service  

After selecting a category, the form will require you to select a validation or service that you need. There are 5 options you can choose from, including:  

  1. General Validation  
  2. Azure Government Trial  
  3. O365 GCC CSP Customer  
  4. O365 GCC trial  
  5. Activate a new Azure government enrollment  

Since this is the most important step, select “General Validation.” It prevents issues that may arise if you plan on using a Microsoft Partner or with your already existing Microsoft LAR (Large Account Reseller) regarding activation, tenant naming, and licensing, among others. 

GCC High Validation

Submitting Organization and Contact Information  

This page collects organizational information such as website, legal name, location, country etc. The organization’s contact person information, such as name, phone number, email, etc., is also collected on this page. The contact person must have the authority to review and accept the Terms and Conditions. In addition, they must be US-based.  

GCC High Validation

Providing Required Documentation or Information  

If you selected “Customers handling government-controlled data,” you will arrive at the page below.   

GCC High

You will be asked to confirm whether your company is registered with:  

  1. General Services Administration (GSA)  
  2. Commercial and Government Entity (CAGE) or  
  3. System for Award Management (SAM.gov) registered Unique Entity ID (UEI)  

Whichever item you select, you will then have to enter the “contract number.” If you select the CAGE option, your company must have a valid CAGE code, which must have an ACTIVE status. If you choose the third option, you must have a valid SAM.gov registered UEI with the registration status “Active Registration” and the purpose of registration as “All Awards.”  

You then will be asked if you are an entity that holds controlled information subject to government regulation. Such types of controlled information include:  

  1. CJI / CJIS: Criminal Justice Information   
  2. CUI: Controlled Unclassified Information   
  3. DFARS: Defense Federal Acquisition Regulation Supplement   
  4. DoD UCNI: Department of Defense Unclassified Controlled Nuclear Information   
  5. DoE UCNI: Department of Energy Unclassified Controlled Nuclear Information   
  6. IRS 1075: Safeguards for Protecting Federal Tax Returns and Return Information   
  7. ITAR: International Traffic in Arms Regulations   
  8. NERC: North American Electric Reliability Corporation  

Finally, you’ll be asked to confirm if you’re registered with the Small Business Association (SBA) and, if so, which type. The Government sometimes awards some federal contracts to socio-economically qualified small businesses. The SBA offers a range of programs to empower small businesses to secure government contracts. Some of these programs are listed on the Supporting Information page of the Government Community Cloud Eligibility Intake Form.  

Submitting the Validation Request  

After filling in all the required information and documentation, you have to agree with Microsoft Government Validation terms and conditions. You also must attest that you have the authority to bind your organizations to these terms. Only after this can you submit the validation request. After this, Microsoft will reach back to you and either:  

  1. Inform your organization that it has been validated or  
  2. Request for additional or different documentation.   

Some of this information may include a sponsor letter that specifies regulated data requirements and the duration of the said requirement. This letter must be signed within the last 12 months. Only a valid US Government entity or approved Category 3 entity (holding the same data type) can sponsor your request. If a signed contract is requested, it should indicate the controlled/regulated data requirement as part of delivery, be it direct or indirect. The data owner entity name must be clearly visible. However, if your organization is validated, you will be asked to work with a qualified partner or Microsoft account team to purchase GCC High.  

Conclusion

The validation process for GCC High may seem daunting, but it is necessary to ensure the security of sensitive government data. Once validated and approved for GCC High, organizations gain access to a powerful cloud solution purpose-built for government contractors and cleared entities. With the ability to store and process highly sensitive data, GCC High opens new opportunities. If you are considering a move to GCC High, our experts at Cleared Systems can guide you through validation, licensing, deployment, and more. With deep expertise in cloud security and compliance for government contractors, we are the ideal partner for your GCC High journey. Contact us today to learn how they can help you capitalize on the benefits of GCC High.  

Frequently Asked Questions

Office 365 Government – GCC High is hosted on a US sovereign cloud  and only available in the United States. Even the support staff working in  data centers hosting Microsoft GCC High data centers are thoroughly vetted US citizens that have undergone serious background screening. This is in line with serious security requirements of the ITAR and DISA CC IL4. Non–US Government customers can choose from a number of Office 365 Government plans.

GCC High is the only cloud solution that guarantees only US citizens will have access to your data. It meets the strict ITAR and other compliance requirements  and is the only Microsoft solution you can implement if your organization handles any data subject to ITAR.

Office 365 GCC High cloud service is designed according to DoD SRG IL4 controls and supports strictly regulated federal and defense information.

Share in Social Media

case studies

See More Case Studies

microsoft 365 GCC High
Microsoft GCC High

What is GCC High? For ITAR & CMMC 2.0

Microsoft 365 Government Community Cloud (GCC) High is a specialized cloud solution tailored for U.S. federal, state, local, tribal, and territorial government organizations, as well as for contractors who hold or process data subject to specific security regulations. In this article, we will explore the features, benefits, and differences between Microsoft 365 GCC High and other Office 365 offerings.

Learn more
Contact us

Partner with Us for Compliance & Protection

We’re happy to answer any questions you may have and help you determine which of our services best fit your needs.

Call us at: 1-888-575-4430
Your benefits:
  • Client-oriented
  • Security
  • Compliance
  • Peace of mind
  • Efficiency
  • Trust
What happens next?
1

Schedule an initial meeting

2

Arrange a discovery and assessment call

3

Tailor a proposal and solution

How can we help you?