# Getting CMMC Right in Microsoft: Webinar Recap and Q&A With Richard Wakeman > Microsoft's Richard Wakeman on GCC vs GCC High, CUI enclaves, Business Premium, and shared responsibility, plus answers to attendee CMMC questions. canonical: https://secureframe.com/blog/getting-cmmc-right-in-microsoft-webinar-recap On November 10, 2026, Richard Wakeman, Chief Security Architect for Aerospace and Defense at Microsoft, joined Secureframe CEO Shrav Mehta for a webinar on how small and mid-sized defense contractors can set up Microsoft for [CMMC](https://secureframe.com/hub/cmmc) without overspending. Wakeman has been helping defense contractors move to Microsoft's government cloud since 2007. They compared Microsoft's [Commercial, GCC and GCC High clouds](https://secureframe.com/blog/gcc-high-vs-gcc), covered when a CUI enclave makes sense and when it doesn't, and answered audience questions on licensing, shared responsibility and foreign nationals. Here are five takeaways from the session, followed by answers to the questions attendees asked about Microsoft and CMMC. ``` ``` ## 5 things Microsoft's DIB security architect wants defense contractors to know ## 5 things Microsoft's DIB security architect wants defense contractors to know ### 1. Commercial Microsoft 365 can't hold CUI For [Controlled Unclassified Information (CUI)](https://secureframe.com/blog/controlled-unclassified-information-cui), this is a yes-or-no decision. [DFARS 252.204-7012](https://secureframe.com/blog/dfars-7012-vs-cmmc) requires a cloud provider that is [FedRAMP Moderate or equivalent](https://secureframe.com/blog/fedramp-equivalency-cmmc), and the Microsoft 365 productivity suite in Commercial has no FedRAMP authorization. If you have CUI in Exchange, SharePoint, OneDrive or Teams, it needs to be in GCC or GCC High. In Wakeman's words: "You cannot use the Office productivity suite in Commercial and get [CMMC Level 2](https://secureframe.com/blog/cmmc-level-2-compliance) certified." The difference is data residency versus data sovereignty. Commercial can keep your data at rest in the US, but support follows the sun and the network is global, so data can still leave the country. GCC is a region of Commercial. [GCC High](https://secureframe.com/blog/microsoft-gcc-high) runs on Azure Government, a sovereign US cloud that is physically and virtually separate from Commercial. The "High" stands for FedRAMP High. It is not a classified environment. ![Microsoft flowchart for choosing between Microsoft 365 Commercial, GCC, and GCC High based on DFARS, ITAR, and CUI requirements](https://images.prismic.io/secureframe-com/H0H_d1MIgUJOpKFq_image1.png?auto=format,compress) ### 2. If you work with the DoW, start on GCC High GCC can hold [CUI Basic](https://secureframe.com/hub/cui/what-is-cui-basic). It is not recommended for [export-controlled data](https://secureframe.com/blog/export-controlled-information-eci) (ITAR/EAR) or [CUI Specified](https://secureframe.com/hub/cui/what-is-cui-specified) with dissemination controls like NOFORN. Across the several hundred defense contractors Wakeman has worked with, he sees "a 90/10 split": roughly 90% go to GCC High. Many have no [ITAR](https://secureframe.com/blog/itar-cybersecurity-requirements) data today, but they could win a contract that brings it, and moving from GCC to GCC High later is, as Wakeman put it, "a very painful migration." The 10% who stay on GCC tend to be healthcare and professional services firms whose CUI Specified always stays in their customers' environments. Most data from the Department of War (DoW) is export-controlled, so contractors working with technical documents should start on GCC High. ![Microsoft slide comparing Microsoft 365 Commercial, GCC, GCC High, and DoD offerings by customer eligibility, FedRAMP level, DFARS 7012, CMMC, ITAR, and data location](https://images.prismic.io/secureframe-com/BAmdMZ53jQ86xiof_image2.png?auto=format,compress) ## Recommended reading Does CMMC Require GCC High? What Defense Contractors Need to Know ### 3. Buying GCC High doesn't make you compliant "If you buy GCC High, you're not magically going to be CMMC compliant," Wakeman said. Microsoft covers data center and physical security. About 86 controls are technical settings you configure yourself, like Intune, Defender for Endpoint and Sentinel, on top of the policies and training behind the [110 NIST SP 800-171 requirements](https://secureframe.com/blog/nist-800-171-compliance). Our guide to the [CMMC shared responsibility model](https://secureframe.com/blog/cmmc-shared-responsibility-model) explains how that split works across Microsoft, your service providers and your own team. ### 4. Enclaves are a starting point, not an end state The typical [CUI enclave](https://secureframe.com/blog/cui-enclave) is a "swivel seat" setup: separate credentials, mailbox and OneDrive, often reached through Windows 365 or Azure Virtual Desktop. It's usually the fastest path to Level 2 and gives assessors a clean boundary. ![](https://images.prismic.io/secureframe-com/aGW1R3fc4bHWi-zl_EnclaveCUIDataFlow-A.png?auto=format,compress) The weak point is spillage. Your Commercial account is your daily driver, so when someone emails CUI to your Commercial mailbox, you have a 72-hour reporting event. Over time, most companies move whole business units or subsidiaries into GCC High, and the large primes are mostly all-in already. ![Microsoft slide showing the spectrum from a CUI data enclave, to a hybrid migration, to going all-in on GCC High](https://images.prismic.io/secureframe-com/TrVLUYpAnJ7kDm-5_image3.png?auto=format,compress) ## Recommended reading CMMC Enclave or Full Environment? How to Make the Right Scoping Call in GCC High ### 5. Business Premium makes GCC High affordable for small companies [Business Premium is now available in GCC High](https://secureframe.com/blog/gcc-high-business-premium) at roughly 40 to 45% of the cost of [G5](https://secureframe.com/marketplace/microsoft/m365-g5-fusl-gcch-sub-per-user-gcc-high). "We fought really hard to get those Business Premium SKUs into GCC High," Wakeman said. It's for companies with up to 500 employees and includes Entra ID, Intune, SharePoint, and Defender for Endpoint, which covers most of what Level 2 needs. ![](https://images.prismic.io/secureframe-com/Iv4hJDrAup2UqbIn_BusinessPremiumGCCHighkeyfacts-3-.png?auto=format,compress) To compare current per-user costs for Business Premium, G3, G5, and F3 licenses, see our [GCC High pricing guide](https://secureframe.com/blog/gcc-high-pricing). ## Microsoft and CMMC: frequently asked questions ## Microsoft and CMMC: frequently asked questions Here are answers to the questions attendees asked about choosing a Microsoft cloud for CMMC, splitting responsibility with Microsoft, and getting ready for an assessment. ### Choosing a cloud **Can we use Microsoft 365 Commercial instead of GCC High? What if CUI never touches our Commercial tenant?** For CUI in Microsoft 365, no. Commercial is fine for Federal Contract Information (FCI) and [CMMC Level 1](https://secureframe.com/blog/cmmc-level-1-compliance). If CUI never touches your Commercial tenant, it can stay out of your [Level 2 scope](https://secureframe.com/blog/cmmc-scope), but you need to document the boundary and the controls that keep CUI out. Azure is different: some Azure Commercial services do hold FedRAMP authorizations, so check each one before using it for CUI. **GCC or GCC High: which fits my situation?** GCC handles CUI Basic. GCC High is built for CUI Specified and export-controlled data like ITAR and EAR, and it's where about 90% of the defense contractors Wakeman works with end up. Our [GCC High vs GCC comparison](https://secureframe.com/blog/gcc-high-vs-gcc) covers the differences in detail. ![](https://images.prismic.io/secureframe-com/HbBevLGSI7CRUuSw_CUIBasicvsCUISpecified.png?auto=format,compress) A few common scenarios: - **A one-person engineering firm that receives building plans:** ask your prime how the documents are marked. CUI Basic without export controls can work in GCC, but if you sell into the DoW, starting on GCC High avoids a migration later. - **A one-person DLA vendor:** DLA data is almost always export-controlled, so GCC High is the recommended choice. Putting export-controlled data in GCC means compensating controls you'll have to defend in an assessment. As Wakeman put it: "If you're in GCC High, they're not going to ask you any questions about the cloud." - **Non-DoD agencies and the FAR CUI rule:** go by the contract clause and the data markings. CUI Basic usually fits GCC, and export-controlled or CUI Specified data points to GCC High. ![](https://images.prismic.io/secureframe-com/aZ0Yr8FoBIGEgs81_GCCHighkeyfacts.png?auto=format,compress) **Should we move the whole company to GCC High, or isolate CUI in an enclave?** It comes down to how many people touch CUI and how predictably it moves. Say you're a 40-person machine shop where 6 engineers and buyers handle drawings from one prime. An enclave means 6 GCC High licenses, and the [C3PAO](https://secureframe.com/hub/cmmc/assessments) assesses a much smaller footprint. If CUI also shows up in sales, shipping and the front office, moving everyone is usually cheaper than policing the boundary. Wakeman's advice is to draw a clean line, like a business unit or subsidiary, so people who sit side by side aren't in different tenants. Cross-cloud collaboration works, but never as well as staying in the same cloud. If you go the enclave route, our [CMMC enclave architecture guide](https://secureframe.com/blog/cmmc-enclave) covers how to build and manage one. ```
Data enclave (swivel seat) All-in GCC High
User population Less than 20% do defense work More than 20% do defense work
Time to set up Fastest path to a compliant environment Longer migration up front
Cost Lower when few users need CUI; you pay two licenses per enclave user Lower overall for larger CUI populations
User experience Users switch accounts, devices and URLs One tenant, one account
Spillage risk Higher: CUI lands in Commercial email and OneDrive Lower
Admin overhead Two tenants with split device, user and access policies One set of policies
``` **What makes migrating to GCC High harder than a normal tenant migration?** There's no upgrade path. Commercial, GCC and GCC High are separate environments, so you [set up a new GCC High tenant](https://secureframe.com/blog/gcc-high-tenant-setup) and migrate identities, [mailboxes](https://secureframe.com/blog/gcc-high-email-migration), files, Teams and devices into it, often as a disruptive big-bang cutover. Some features also work differently, so review the [GCC High limitations](https://secureframe.com/blog/gcc-high-limitations) before you plan the cutover. If you'll ever need GCC High, start there. ## Recommended reading GCC High Migration Guide: Step-by-Step for Defense Contractors ### Small and remote businesses **Does Microsoft offer a low-cost, always-compliant enclave for small businesses?** No, and that's true of every cloud provider. "It's too much liability for Microsoft to actually manage a service and be the cloud service provider at the same time," Wakeman said. Microsoft offers what Wakeman calls "scaffolding" instead: the [Product Placemat for CMMC](https://aka.ms/cmmc/productplacemat), the [Technical Reference Guide for CMMC](https://aka.ms/cmmc/techrefguide), the FedRAMP package with its customer responsibility matrix, and Compliance Manager templates. From there, you build it yourself or work with a partner who has set up enclaves before. **What are the CMMC options for a fully remote company spread across the US?** Go cloud-native and keep on-prem networks out of scope. One option is a [virtual desktop](https://secureframe.com/secureframe-virtual-desktops) with USB and printing turned off, which keeps physical laptops out of scope. Another is to enroll laptops in Intune and Defender, which come with Business Premium and G5. Either way, home offices count as alternate work sites and need a policy. ![Diagram showing a Secure Virtual Desktop for CUI data and workflows vs. non CUI systems and devices](https://secureframe-com.cdn.prismic.io/secureframe-com/aPD_155xUNkB2D4l_2-CUIvsNon-CUI.svg) ### Shared responsibility **What do we have to configure ourselves in GCC High for Level 2, and where's the shared responsibility matrix?** Microsoft's customer responsibility matrix (CRM) is part of its FedRAMP Body of Evidence, an Excel file inside the Control Implementation Summary. For GCC and Azure Commercial it's on the [Service Trust Portal](https://aka.ms/stp). For GCC High, email [O365FedRAMP@microsoft.com](mailto:O365FedRAMP@microsoft.com), and for Azure Government email [AzFedDoc@microsoft.com](mailto:AzFedDoc@microsoft.com). You'll need to be a customer and sign an NDA. For a plain-English version, our [CMMC Shared Responsibility Matrix for Microsoft GCC High](https://secureframe.com/compliance-resources/cmmc-shared-responsibility-matrix-for-microsoft-gcc-high) maps all 110 requirements and shows which are inherited, shared or yours. ### Teams and assessment evidence **Does Teams count as VoIP under SC.L2-3.13.14, and how should we handle it?** Use Teams in GCC High, configured for NIST SP 800-171. Many DIB companies, including the largest primes, allow meeting recordings and Copilot transcripts there. If you run an enclave, the hard part is behavioral. Each user picks whether to join a meeting with their Commercial or their GCC High account, and no technical setting can force the right choice. "You have to train your people for that," Wakeman said. **Do CMMC assessors accept Microsoft tools as evidence?** Yes. Configuration exports, audit logs and Intune compliance reports all count. A Compliance Manager score or template checkmark doesn't count on its own. Assessors want an artifact showing each objective is implemented and operating. Our guide to [CMMC controls](https://secureframe.com/hub/cmmc/controls) explains what each requirement asks for. ### Foreign nationals and international operations **Can foreign nationals and overseas affiliates use GCC High?** Yes. In Wakeman's words, "there's no restriction in terms of citizenship or even location" for connecting to Microsoft's government clouds. You decide who gets accounts and guest access in your tenant. The one firm caution: don't add users from the embargoed countries listed in ITAR 126.1. Access to export-controlled data is still governed by your [ITAR and EAR obligations](https://secureframe.com/hub/cui/vs-itar). The tenant itself must be bought by an eligible entity, usually the US subsidiary that holds the DoW contract, and GCC High data stays in the US. Many large primes run GCC High for their worldwide workforce. Most multinationals run GCC High for the US entity and Commercial for everyone else, connected by cross-cloud collaboration. ### Primes and sub-tier suppliers **How can primes use enclaves or VDI to work with sub-tiers that aren't yet required to hold Level 2, without forcing them into full GCC High migrations?** A common setup is for the prime to host the CUI. Sub-tier users get accounts or guest access in the prime's GCC High tenant, or Azure Virtual Desktop sessions in Azure Government, so CUI never lands on the supplier's systems. Wakeman's virtual desktop infrastructure (VDI) approach applies here too: with USB and printing turned off, the supplier's own laptops can stay out of scope. Put the arrangement in your [flow-down terms](https://secureframe.com/blog/cmmc-requirements-for-subcontractors). ![](https://images.prismic.io/secureframe-com/aZ0WQsFoBIGEgs8v_who-needs-microsoft-gcc-high.png?auto=format,compress) ### Engineering applications **How do you run engineering tools like AutoCAD, Revit or SolidWorks with CUI?** There's no secret sauce, according to Wakeman. Engineering tools are usually the second or third step after you set up email and Teams. Siemens Teamcenter, PTC Windchill and Dassault SolidWorks all run well in Azure Government, which offers GPU-backed VMs and landing zones like Mission Landing Zone. Keep CUI files in GCC High or Azure Government storage, not in a commercial Autodesk cloud service. Many SolidWorks shops skip VDI and run physical workstations enrolled in Intune and Defender, with physical access controls on the room. ### CMMC status and getting started **Should we get a CMMC assessment while Phase 2 is paused?** It depends on what your primes are asking for. C3PAO assessments are still available and a Level 2 certificate remains a differentiator with primes, while Phase 1 self-assessments, DFARS 7012 and NIST SP 800-171 Rev 2 still apply either way. See our [CMMC Phase 2 pause update](https://secureframe.com/blog/cmmc-news-2026-phase-2-pause) for the current status and what to do now. ![](https://images.prismic.io/secureframe-com/aRygtmGnmrmGp_d0_DFARS%2CNIST%2CCMMCRelationship%402x.png?auto=format,compress) **How do we get started with CMMC and prepare for a self-assessment?** Start with scoping: where CUI comes in, where it's stored and who touches it. Then pick your cloud, run a [gap analysis](https://secureframe.com/blog/cmmc-gap-analysis) against the 110 requirements, write your [System Security Plan (SSP)](https://secureframe.com/blog/cmmc-ssp), and post your [SPRS score](https://secureframe.com/blog/cmmc-sprs). Our [CMMC self-assessment guide](https://secureframe.com/blog/cmmc-self-assessment) walks through each step. ### Automation **Can CMMC compliance be automated with agentic orchestration?** Much of the work can be: evidence collection, configuration monitoring, policy drafting and keeping your SSP current. Training, personnel decisions, physical security and the senior official's affirmation stay with people. [CMMC compliance automation](https://secureframe.com/hub/cmmc/automation) pays off most in proving your controls are still in place between assessments, which is where DoW CIO Kirsten Davies has signaled the program is headed. ## Recommended reading What the DoW CIO Signaled about CMMC Reform at DIBX 2026 ## Get GCC High licenses and CMMC help from Secureframe ## Get GCC High licenses and CMMC help from Secureframe Secureframe is an authorized Microsoft reseller for GCC and GCC High, including G5 and Business Premium. Request a quote and you'll get pricing within one business day. - [Browse GCC High licenses](https://secureframe.com/marketplace/microsoft/category/microsoft-365-suites/gcc-high) - [Request a Microsoft license quote](https://secureframe.com/marketplace/quote) - [Download the CMMC Shared Responsibility Matrix for GCC High](https://secureframe.com/compliance-resources/cmmc-shared-responsibility-matrix-for-microsoft-gcc-high) - [Download the CMMC Level 2 compliance checklist](https://secureframe.com/compliance-resources/cmmc-level-2-compliance-checklist) - **Watch the recording:** [Getting CMMC Right in Microsoft](https://youtu.be/KhXTMe1ItOA) - **Read Wakeman's full blog:** [Understanding Compliance Between Commercial, Government, DoD & Secret Offerings](https://aka.ms/MSGovCompliance) Still have a question we didn't cover? Email [hello@secureframe.com](mailto:hello@secureframe.com), or [book time with our team](https://secureframe.com/request-cmmc-demo) to talk through your scoping or migration plan. ### License, build, and manage your enclave