The decision before the migration
Your contracts decide whether you need GCC High. ITAR/EAR technical data and the data-sovereignty requirements that come with it, the incident-reporting duties in DFARS 252.204-7012 paragraphs (c) through (g), and prime flow-downs determine whether commercial M365 (properly configured), an enclave, or a full GCC High migration fits. We wrote the decision model down in GCC High vs. Commercial M365; read it before anyone quotes you licensing.
How the migration runs
- Scope and tenant design start with the CUI boundary and then the tenant architecture. The boundary decides who migrates, what stays, and what the assessment will test.
- Tenant provisioning and identity cover standing up the GCC High tenant, the Entra ID architecture, a Conditional Access baseline, and hybrid identity where legacy systems need it.
- Mail and data migration runs as a staged cutover without service interruption. CUI labeling and DLP (Purview) are configured before any data lands.
- Boundary configuration and hardening deploys Intune baselines, Defender, WDAC, and audit logging as the migration completes, documented as evidence from the first day.
- Documentation comes out of the migration itself: the SSP sections, network diagrams, and data-flow documentation your assessor will ask for, so nobody has to reconstruct them later.
Only some of your people handle CUI? CUIckStart is our managed CUI enclave on GCC High: only the named people who handle CUI move into the boundary, and the rest of the business and the corporate network stay out of the assessment scope. Standard is ready in 60 days, Express in 14. See how it works or cuickstart.com.
The phase-by-phase plan is public. The GCC High Migration Timeline guide walks through the full sequence: what moves when, what breaks if you do it in the wrong order, and where the long-lead items are.
Questions contractors ask us
Do we need GCC High to handle CUI?
Not always. It depends on whether your data carries ITAR/EAR or other sovereignty requirements. Many contractors can meet 800-171 in commercial M365 with the right configuration, while export-controlled CUI generally points to GCC High. We scope this from experience, since our own certified environment runs there.
How long does a GCC High migration take?
It depends on tenant complexity, mail volume, and identity architecture, which is why we publish the phase-by-phase plan in the GCC High Migration Timeline guide. The order stays the same: identity first, then mail, then workloads, with the CUI boundary configured before data moves so the migration itself generates assessment evidence.
Can we run a hybrid, with some users in GCC High and some in commercial?
Yes. An enclave architecture puts only CUI-touching users and workloads in the federal cloud, which shrinks both licensing cost and assessment scope. Whether it's cheaper than a full migration depends on how cleanly your CUI population separates. That is a boundary question first and a licensing question second. CUIckStart is that enclave as a managed product.
Scope the assessment and the migration as one decision.
Scoping both together means you only buy the architecture once. Or email rj@indirectit.com directly.