Understanding Compliance Between Microsoft 365 Commercial, GCC, GCC-High and DoD Offerings

Hello RichardWakeman and Shawn_Veney.  At an event last year I asked RichardWakeman if there was any difference when declaring an incident in GCC and GCC High.   He stated that the reporting was the same.  I assume that means attestations letters for GCC and GCC High are also the same?  Would you mind providing some background into how Microsoft responds to the (e) of the DFARS 252.204-7012 "preserve and protect images of all known affected information systems?  I am not aware of any large SaaS provider who is able to provide images but wanted to bring it to the forefront for discussion. 

Thank you for both again for creating this blog.  I reference it often.

Terry

(e)  Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.