The decision before the migration
GCC High is not automatically the answer. The decision is contract-driven: ITAR/EAR technical data, DFARS 252.204-7012 (c)–(g) incident-reporting and sovereignty requirements, and prime flow-downs determine whether commercial M365 (properly configured), an enclave, or a full GCC High migration fits. We wrote the decision model down — read GCC High vs. Commercial M365 before anyone quotes you licensing.
How the migration runs
- Scope & tenant design — CUI boundary first, then tenant architecture. The boundary decides who migrates, what stays, and what the assessment will test.
- Tenant provisioning & identity — GCC High tenant stand-up, Entra ID architecture, Conditional Access baseline, and hybrid identity where legacy systems require it.
- Mail & data migration — staged cutover without service interruption, with CUI labeling and DLP (Purview) configured before data lands, not after.
- Boundary configuration & hardening — Intune baselines, Defender, WDAC, and audit logging deployed as the migration completes — documented as evidence from day one.
- Documentation output — the migration produces the SSP sections, network diagrams, and data-flow documentation your assessor will ask for. Nothing is reconstructed later.
Only some of your people handle CUI? CUIckStart is our managed CUI enclave on GCC High: only the named people who handle CUI move into the boundary, and the rest of the business and the corporate network stay out of the assessment scope. Standard is ready in 60 days, Express in 14. See how it works or cuickstart.com.
The phase-by-phase plan is public. The GCC High Migration Timeline guide walks the full sequence — what moves when, what breaks if you order it wrong, and where the long-lead items hide.
Questions contractors ask us
Do we need GCC High to handle CUI?
Not always — it depends on whether your data carries ITAR/EAR or other sovereignty requirements. Many contractors can meet 800-171 in commercial M365 with the right configuration; export-controlled CUI generally points to GCC High. We scope this from experience, not a sales sheet — our own certified environment runs there.
How long does a GCC High migration take?
It depends on tenant complexity, mail volume, and identity architecture — which is why we publish the phase-by-phase plan in the GCC High Migration Timeline guide. The structural answer: identity first, then mail, then workloads, with the CUI boundary configured before data moves, so the migration itself generates assessment evidence.
Can we run a hybrid — some users in GCC High, some commercial?
Yes. An enclave architecture puts only CUI-touching users and workloads in the federal cloud, which shrinks both licensing cost and assessment scope. Whether it's cheaper than a full migration depends on how cleanly your CUI population separates — that's a boundary question before it's a licensing question. CUIckStart is that enclave as a managed product.
Scope your migration as one decision, not two.
Assessment and migration scoped together — so you don't buy the architecture twice. Or email rj@indirectit.com directly.