GCC vs. GCC High: Key Differences and CMMC Relevance
XQ + Meerkat Position Paper
Authors:
Government contractors handling Controlled Unclassified Information (CUI) must choose the right Microsoft cloud environment to meet the requirements of the Cybersecurity Maturity Model Certification (CMMC) and DFARS 7012.
Government Community Cloud (GCC) and Government Community Cloud High (GCC High) are the primary options.
Is Microsoft GCC High Required for CMMC?
All Microsoft platform products are ESP products that require FedRAMP for CMMC.
Microsoft's guidance often points to GCC High, which has FedRAMP authorization, as the preferred environment for CMMC compliance, but this approach limits options for organizations seeking cost-effective and flexible solutions.
Seeking third-party options often leaves customers with limited choices to protect CUI.
With XQ, there is an alternative.
This position paper shows how XQ’s approach effectively secures CUI and is compliant with Cybersecurity Maturity Model Certification (CMMC) requirements and enables a lower-cost alternative for customers without moving to the GCC High environment.
1. Government Community Cloud (GCC)
Overview:
Hosted on Microsoft’s commercial infrastructure but isolated for U.S. federal, state, local, and tribal government entities.
Designed to meet FedRAMP Moderate and CJIS compliance requirements.
Security & Compliance:
Meets CMMC Level 1 & 2 (for non-CUI workloads)
FedRAMP Moderate certified
Supports NIST SP 800-171 compliance (with additional security measures)
Hosted within the U.S., but support staff may include non-U.S. persons
Use Case:
Suitable for organizations that do not process ITAR or CUI data requiring DFARS 7012 compliance.
Used by agencies and contractors who need government security but can operate under FedRAMP Moderate.
2. Government Community Cloud High (GCC High)
Overview:
Hosted on Microsoft Azure Government, a physically and logically separate U.S. government cloud infrastructure.
Designed for DoD contractors, federal agencies, and organizations processing CUI or ITAR data.
Security & Compliance:
Meets CMMC Level 2 & 3 (for handling CUI and ITAR data)
FedRAMP High & DoD IL4/IL5 certified
Compliant with DFARS 7012, NIST SP 800-171, and NIST SP 800-53
All data and support services are handled exclusively by U.S. citizens on U.S. soil
Use Case:
Required for organizations handling CUI subject to DFARS 7012, ITAR, or other sensitive DoD-related data.
Necessary for contractors working with DoD Impact Level 4 & 5 data.
Key Differences at a Glance
Feature: Infrastructure
GCC Commercial Microsoft Cloud
GCC High: Azure Government (Separate U.S. Gov Cloud)
Feature: CMMC Compliance
GCC: Level 1 & 2 (non-CUI) on GCC Moderate and High
GCC High: Level 2 & 3 (CUI & ITAR)
Feature: DFARS 7012 / ITAR
GCC: Not fully compliant without XQ
GCC High: Fully compliant
Feature: FedRAMP Level
GCC: Moderate
GCC High: High
Feature: DoD Impact Level
GCC: IL2
GCC High: IL4/IL5
Feature: Support Staff
GCC: May include non-U.S. persons. * XQ revents non-US citizen access
GCC High: Only U.S. citizens, on U.S. soil
XQ’s Role: A GCC Alternative to GCC High
While Microsoft recommends GCC High for handling CUI, this limits organizations to Azure Government and Microsoft 365 GCC High, which can be costly and complex to adopt. XQ's Zero Trust Data solution enables organizations to remain in GCC while achieving CMMC compliance by:
Encrypting CUI at the endpoint, preventing unauthorized access
Storing encryption keys externally but US located, eliminating data residency concerns
Enforcing role-based access control (RBAC) to restrict data exposure
Providing a unique chain of custody for every data object to support audibility
How XQ Supports CMMC Compliance Without GCC High
Endpoint Encryption with External Key Management
XQ encrypts CUI at the source before transmission, ensuring data security independent of the underlying cloud infrastructure.
Encryption keys are managed externally,outside Microsoft, preventing cloud providers from accessing or controlling sensitive data.
Data Residency and Sovereignty Compliance
Unlike GCC High, where data must reside within Azure Government, XQ allows organizations to operate in GCC, AWS, or hybrid environments while maintaining compliance.
Organizations retain full control over where encryption keys are stored, addressing data sovereignty concerns.
Role-Based Access Control (RBAC) and Zero Trust Enforcement
XQ applies granular access controls, ensuring only authorized users can access specific data.
Integrates with existing Identity and Access Management (IAM) systems to enforce least privilege access.
Secure Data Exchange Across Platforms
Enables secure file transfers and communications across GCC, AWS, and hybrid environments.
Ensures CUI remains protected, even when shared outside traditional government cloud environments.
The Advantage of GCC + XQ Over GCC High
Feature: Security Plane
GCC High: Data + Security in same system
GCC with XQ: XQ external security + policy control plane
Feature: Cloud Provider
GCC High: Microsoft Azure Gov
GCC with XQ: Any (GCC, AWS, Hybrid)
Feature: Data Encryption
GCC High: Microsoft-controlled
GCC with XQ: End-to-end Zero Trust
Feature: Key Management
GCC High: Stored within Azure Gov
GCC with XQ: External to cloud provider
Feature: Role-Based Access Control (RBAC)
GCC High: Limited to Microsoft’s policies
GCC with XQ: Fully customizable, Zero Trust-based
Feature: Chain of Custody
GCC High: Limited tracking
GCC with XQ: Unique, tamper-proof audit trail for each data object. Record of IP, identity, location of access.
Feature: Data Residency Flexibility
GCC High: U.S. only
GCC with XQ: Global with compliance controls
Feature: Cost & Complexity
GCC High: High
GCC with XQ: Lower, scalable alternative
GCC Summary and Recommendation
XQ’s Zero Trust Data solution allows organizations to achieve CMMC compliance while avoiding the cost and rigidity of GCC High.
By encrypting data at the endpoint, externalizing key management, enforcing RBAC, and ensuring a full chain of custody, XQ enables organizations to secure CUI within GCC or other cloud environments without sacrificing compliance or security.
Summary
XQ’s Zero Trust Data solution provides comprehensive protection for Controlled Unclassified Information (CUI) while ensuring compliance with CMMC requirements in GCC environments. By encrypting data at the endpoint and storing encryption keys externally, XQ effectively removes data residency concerns and limits cloud provider access to CUI, offering a strong alternative to Microsoft's GCC High environment.
Recommendation
Organizations handling CUI in the cloud should adopt XQ’s Zero Trust Data solution as a compliant, secure, and flexible alternative to GCC High and Azure Government.
By maintaining full control over encryption keys and data access, XQ enables organizations to meet CMMC mandates while enhancing data security, sovereignty, and operational resilience.
