Summary of Understanding GCC High, GCC and Commercial Microsoft 365

00:00:00 - 00:15:00

This video discusses the differences between Microsoft 365 commercial, government community cloud GCC, and GCC high. The main points to take away are that GCC high is a cloud-based high-impact environment that meets FedRAMP high-impact requirements, and GCC high is not a high side environment, and that office 365 is built on globally replicated directory services and a global network.

• 00:00:00 This video discusses the differences between Microsoft 365 commercial, government community cloud GCC, and GCC high. The main points to take away are that: -GCC high is a cloud-based high-impact environment that meets FedRAMP high-impact requirements, and -GCC high is not a high side environment, and that office 365 is built on globally replicated directory services and a global network.
• 00:05:00 Microsoft 365 is a cloud-based suite of applications that has many features that are helpful for meeting compliance requirements. However, one key difference between Microsoft 365 commercial and Microsoft 365 GCC is that commercial is not able to provide the data sovereignty required by ITAR. Microsoft created Azure Government, which is a separate instance of Azure that exists in a compliance boundary dedicated to US government workloads. This allows Microsoft to meet the compliance accreditation for FedRAMP I and requirements for US defense regulations like D FAR's ITAR and CMC.
• 00:10:00 Microsoft offers a range of cloud services, including commercial, GCC High, and DOD. These services have different compliance levels, with commercial not meeting any of the frameworks discussed. GCC Hi meets D FAR's requirements, but does not allow contractual flow downs for D FAR's.
• 00:15:00 The video explains that both GCC and DoD's screening processes for employees include a number of checks, including standard background checks, foreign asset controls, and fingerprinting against the FBI database. However, in order to support GCC High (which requires employees to complete three investigations from the Office of Personal Management) Microsoft personnel must also complete a different background check, known as a Confidential and Secret Access check. The video provides a brief overview of the GCC High e-book and recommends that viewers download it to learn more about the process.