A CISO's Guide to Securing AI - Securing AI for Federal, DIB, and DoW Entities
Artificial Intelligence (AI) is rapidly reshaping federal missions, defense operations, and critical infrastructure. From intelligence analysis to logistics and cyber defense, AI’s transformative power is undeniable. Yet, with great power comes great responsibility and risk.Microsoft 365 Copilot is now available in GCC-High
Update December 2, 2025: This post has been revised to clarify the availability timeline for Copilot Search in the Microsoft 365 Copilot App. It will be rolling out as part of Wave 2, in the first half of 2026. We’re excited to announce that Microsoft 365 Copilot is now available for customers in GCC-High, bringing powerful work-ready AI capabilities to organizations with the highest security and compliance requirements. This announcement builds on previous launches in the GCC and DoD cloud environments over the last year. Trusted AI, built for confidence Microsoft 365 Copilot combines the capabilities of large language models with Work IQ—the intelligence layer that helps Copilot understand you, your job, and your company—and weaves this understanding into familiar Microsoft 365 apps like Word, Excel, PowerPoint, and Outlook to help you work smarter and faster. With Microsoft 365 Copilot, agencies can streamline citizen services by drafting responses and summarizing case files in minutes. They can empower staff to manage budgets effectively by analyzing spending trends and generating compliance-ready reports, all within the Microsoft 365 apps where they already work today. Copilot for GCC-High is built to meet the strict regulatory frameworks many agencies and adjacent organizations operate under, adhering to FedRAMP High, DFARS, ITAR, CMMC, and other critical compliance requirements. Key protections include: Data Residency and Isolation: All data remains within U.S.-based data centers managed by screened U.S. personnel, ensuring compliance with government mandates. Encryption and Access Controls: Data is encrypted in transit and at rest, with Microsoft Entra ID enforcing role-based access. Responsible AI by Design: Copilot incorporates Microsoft’s Responsible AI principles, including safeguards against prompt injection and misuse. To ensure sensitive government data does not leave the GCC-High compliance boundary, Microsoft 365 Copilot is delivered to GCC-High with web grounding OFF by default. Shifting this setting to ON where appropriate will improve the quality of Copilot responses. For more details, visit Data, Privacy, and Security for Microsoft 365 Copilot. Capabilities in GCC-High today – and beyond Microsoft 365 Copilot customers in GCC-High will gain access to a powerful suite of features immediately, with more to come in Wave 2. As of today, the following capabilities are available or have begun rolling out in Microsoft 365 Copilot for GCC-High: Copilot in Microsoft 365 Apps: Integrated AI experiences in Word, Excel, PowerPoint, Outlook, and Teams, enabling users to draft, analyze, and collaborate securely within familiar productivity tools. These capabilities are designed to meet the strict compliance and data residency requirements of GCC-High, with all data stored in U.S.-based data centers and managed by screened U.S. personnel. Premium features in Copilot Chat: Copilot Chat with web grounding (default OFF) and the ability to reason over uploaded files is included with eligible Microsoft 365 plans (rolling out now). Adding a Microsoft 365 Copilot license unlocks full work data reasoning with Work IQ, deeper integration with Microsoft 365 apps, and extensive customization options[1] for secure integration with external data sources and custom workflows, with administrative controls to ensure security and compliance. Learn more about the relationship between Microsoft 365 Copilot and Copilot Chat. Compliance-Ready AI and Security Controls: Copilot for GCC-High is built to meet strict regulatory frameworks, including FedRAMP High, DFARS, ITAR, and CMMC. Data is encrypted in transit and at rest, with role-based access enforced by Microsoft Entra ID. Microsoft Purview and Enterprise Data Protection (EDP) are natively integrated for security, governance, and policy enforcement. Copilot Control System: Provides IT management controls, license management, and compliance monitoring. Administrators can configure and monitor Copilot usage to ensure alignment with organizational policies. Controls are conveniently centralized within the Microsoft 365 admin center. Notebooks and Pages in the Microsoft 365 Copilot App: Use Notebooks and Pages for collaborative work within the dedicated app. Wave 2 features are expected to ship to GCC-High in the first half of 2026. These include: GPT-5: Delivers faster, more accurate, and context-aware responses for advanced analysis and problem solving, while maintaining strict compliance within GCC-High boundaries. Image Generation: Enables users to create custom visuals from text prompts directly in chat and Microsoft 365 apps, with built-in compliance controls for secure usage and sharing. Code Interpreter: Allows secure Python code execution for data analysis, visualization, and automation, supporting advanced analytics and repetitive task automation. Researcher Agent: Provides deep research capabilities, synthesizing insights from organizational content and the web (where permitted), with source-cited, well-organized reports. Analyst Agent: Acts as a virtual data scientist, analyzing structured and unstructured data, visualizing trends, and supporting strategic decision-making. Microsoft 365 Copilot Connectors: Enable integration with third-party and line-of-business data sources, enabling secure, compliant workflows that extend Copilot’s reach beyond Microsoft 365. Copilot Search in the Microsoft 365 Copilot App: Harness Copilot Search for intelligent and context-aware information retrieval within the dedicated app. All of these features will be tailored to meet the strict security, compliance, and data residency requirements of GCC-High. For the latest roadmap and availability updates, refer to the official Microsoft 365 Roadmap and Microsoft 365 Copilot Service Description. Next steps For federal agencies in GCC-High who purchase through the GSA, significant discounts are currently available under the OneGov agreement announced in September, including the opportunity to use Microsoft 365 Copilot at no additional cost for up to 12 months with Microsoft 365 G5. Additional resources are listed below. Reach out to your account team or partner to learn more, request a demo, or get started with Microsoft 365 Copilot in GCC-High today. Resources Documentation and Admin Controls: Microsoft 365 Copilot overview Copilot Control System Overview Microsoft 365 Copilot Service Description Data, Privacy, and Security for Microsoft 365 Copilot Microsoft Purview data security and compliance protections for generative AI apps Apply principles of Zero Trust to Microsoft 365 Copilot Adoption Resources for Public Sector Customers: Copilot Readiness and Adoption Guide for Public Sector Customers Copilot Government Scenarios [1] Not all customization options are currently available in GCC-High. For up-to-date feature availability information refer to the Microsoft 365 Copilot Service Description.Two Public Sector Roundtables at PPCC25
Heading to the Power Platform Community Conference in Las Vegas? Don’t miss two sessions designed for the public sector. The Microsoft Sovereign Cloud Architect Panel gives U.S. GCC, GCC High, and DoD customers direct access to Microsoft experts for roadmap and security insights. Meanwhile, Powering Public Impact brings together global government and education leaders to share strategies for governance, AI adoption, and scaling low‑code innovation. Join these conversations to learn, connect, and shape the future of digital transformation in government.Join Microsoft at IACP 2025: Empower public safety operations with trusted AI
The International Association of Chiefs of Police (IACP) Annual Conference and Exposition is the premier global event for law enforcement leaders, bringing together more than 16,000 public safety professionals. This year, IACP 2025 takes place October 18–22 at the Colorado Convention Center in Denver, and Microsoft is proud to be part of the conversation. As your trusted partner in public safety innovation, we invite you to connect with us at booth #362 to discover how Microsoft and our ecosystem of partners are helping agencies modernize operations, improve decision-making, and build safer communities through trusted AI. Microsoft’s presence at IACP 2025 centers around three key pillars that reflect the evolving needs of law enforcement and public safety agencies: Empower the government workforce Streamline workflows with secure AI copilots, enhance collaboration across departments, and boost efficiency with intuitive digital tools. Enable AI-driven decision making Accelerate officer workflows with real-time insights and unify data to support faster, more informed decisions. Transform emergency response Modernize communications, integrate systems for real-time situational awareness, and automate operations to improve coordination and outcomes. Experience Innovation Firsthand At booth #362, attendees can explore hands-on demos of Microsoft solutions including Microsoft 365 Copilot, Researcher and Analyst agents, and Copilot Studio agents tailored for first responders. These tools are designed to help agencies work smarter, respond faster, and serve communities more effectively. You’ll also have the opportunity to connect with our partners, Altia, DisasterTech, Insight, Pimloc, Remark, Revelen.AI, Triangula, and Zencos who are showcasing their solutions that support officer workflows, evidence management, reporting, and analytics. Don’t miss the Emergency Response Platform vehicle demo, supported by Darley, Dejero, and 3AM which highlights how AI and real-time data can transform field operations and emergency response at the tactical edge. Attend Our Thought Leadership Session Join us for a featured education session in the Leadership Track: Is "Technology Sharing" the Key to Law Enforcement Innovation? 📅 Saturday, October 18 🕤 9:30 – 10:30 AM MT 📍 Room 505/506 This session explores how collaborative platforms and shared technology models can reduce costs, accelerate deployment, and improve outcomes across jurisdictions, offering a blueprint for scalable innovation. Let’s Connect We’d love to meet with you one-on-one to discuss your agency’s goals and challenges. Request a meeting with a Microsoft expert to explore how AI and cloud technologies can support your mission. Visit Microsoft at booth #362 to explore AI-powered public safety solutions and skilling opportunities. Together, we can build safer, more resilient communities through innovation.Understanding Compliance Between Commercial, Government, DoD & Secret Offerings - July 2025 Update
Understanding compliance between Commercial, Government, DoD & Secret Offerings: There remains much confusion as to what service supports what standards best. If you have CMMC, DFARS, ITAR, FedRAMP, CJIS, IRS and other regulatory requirements and you are trying to understand what service is the best fit for your organization then you should read this article.
