Forum Discussion
Requirements/Need for GCC High
I have gone back and forth with Microsoft Support about the need for GCC High. Below is the last interaction I had with them regarding the need for it. They had someone call me to explain it and I explained my understanding with no response, so I assume it's correct.
As I understand it and as the CMMC currently stands, knowing it is not fully finalized, we will only need GCC licenses and a sub-tenant if we are awarded a contract that has ML-4 or ML-5 requirements. However, we need to configure our primary tenant to the required ML and be certified at the level prior to bidding to show we have the capability to properly store, manage, and protect the data. If we are awarded we then apply for the GCC tenant and will be required to pay a Microsoft Business Partner setup the GCC sub-tenant and configure the tenant to ML-4 or ML-5, even though we have demonstrated we know how to configure it, because that is a DoD requirement. Please let me know if there are any errors in the process I have just outlined. I understand these requirements may change as the finalized CMMC version is published.
Can anyone verify this? My company is working toward ML-3, and I'm still confused as to whether we should be in a GCC High tenant. I saw those licenses available for purchase on the CMMC Marketplace site, making it appear like any DIB company could go that route.