Microsoft 365 GCC High
by Microsoft
Overview
Microsoft 365 GCC High by Microsoft is an email & messaging solution.
What CMMC 2.0 certifies
CMMC 2.0 certifies your environment, not a product. Microsoft 365 GCC High is one component inside that boundary. The NIST SP 800-171 controls it does not address are yours to cover elsewhere — in other tools, in process, and in your System Security Plan (SSP) — before a CMMC 2.0 assessment.
NIST SP 800-171 control families
The 110 requirements a CMMC 2.0 Level 2 environment is assessed against, by family. Use them to record, in your SSP, which ones Microsoft 365 GCC High addresses for you and which stay yours.
Browse the NIST SP 800-171 control families →Other Email & Messaging products
Related Compliance Assessments
Frequently Asked Questions
Is Microsoft 365 GCC High CMMC compliant?
No product is CMMC-certified; CMMC 2.0 certifies your organization's environment. Microsoft 365 GCC High is one component inside that boundary; the NIST SP 800-171 controls it does not address are yours to cover elsewhere.
What does CMMC 2.0 certify?
Your organization's environment — the people, processes and systems that handle CUI — assessed against the 110 NIST SP 800-171 requirements. It does not certify individual products such as Microsoft 365 GCC High.
Check your full tech stack
80+ enterprise tools in a CMMC 2.0 environment.
Open the CMMC 2.0 readiness check