Scoping · 2026-09-12 · 7 min
GCC High: do you actually need it?
Microsoft GCC High is powerful and expensive. Here's how to decide whether your CUI footprint justifies it.
Having led GCC High implementations, I get this question constantly. The answer depends on what data you hold and how widely it spreads across your business.
When it's the right call
- You handle export-controlled data (ITAR/EAR).
- CUI touches most of your workforce.
- Your primes require it contractually.
When an enclave is smarter
If CUI is limited to a small engineering or contracts team, a scoped enclave can reduce cost and audit surface while keeping the rest of the business agile.
— Nathanael Dick, CISSP, CCP