CMMC Enclave or All-In? Decide the Scope Before You Choose the Cloud

One of the most expensive mistakes a defense contractor can make during CMMC preparation is starting with a technology decision.

Should we move to Microsoft 365 GCC High?

Should everyone move?

Should we build an enclave?

Those are important questions. They are just not the first questions.

The better place to start is simpler:

Where does Controlled Unclassified Information actually move through your organization, and how much of your business needs access to it?

That answer should drive the scope of your environment. The scope should drive the architecture. And only then should the architecture drive decisions about Microsoft GCC, GCC High, or another technology platform.

Start with the CMMC boundary

CMMC does not automatically place every employee, laptop, server, SaaS application, and office inside the same assessment boundary.

DoD's CMMC framework allows an organization to pursue a CMMC status for its entire enterprise network or for a defined enclave, depending on where the information being protected is processed, stored, or transmitted.

That creates an important architectural choice for manufacturers and other defense contractors:

Do you bring most or all of the organization into the CMMC environment, or isolate CUI within a smaller, controlled environment?

Neither answer is automatically right.

The decision depends on how your company actually works.

When an all-in environment may make sense

For some defense contractors, military work is deeply integrated into normal operations.

Engineering may receive controlled drawings. Program managers work with them. Quality needs them. Production depends on them. Employees exchange information through email and collaboration platforms. ERP, file storage, CAD/CAM, and other systems may all participate in the workflow.

Trying to separate that activity into a small enclave can create operational friction.

People may have to switch environments throughout the day. Files can be moved into the wrong system. Employees may use the wrong mailbox or collaboration space. Integrations become more complicated.

In an organization where defense work represents a significant share of day-to-day operations and CUI naturally touches much of the business, bringing a larger portion of the environment into scope may ultimately be easier to manage.

A practical planning question we often use is:

Is defense work a major part of how this company operates, or is it a relatively contained part of the business?

As a rule of thumb—not a regulatory threshold—if roughly half or more of the organization's work is defense-related and CUI is broadly distributed across people and systems, an all-in architecture deserves serious consideration.

But percentage of revenue or military work does not determine CMMC scope by itself. The actual flow of CUI does.

When an enclave may make more sense

Now consider a manufacturer with 150 employees where only 20 routinely work on programs involving CUI.

Perhaps those employees are concentrated in engineering, quality, and program management.

The remaining employees do not need controlled drawings, controlled technical data, or other CUI to perform their jobs.

In that situation, expanding the compliance environment across all 150 employees may introduce cost and complexity that provides little additional protection.

A properly designed enclave can limit the CMMC boundary by separating the people, systems, and workflows that handle CUI from the rest of the enterprise.

DoD scoping guidance explicitly recognizes physical and logical separation as ways organizations can limit the assessment scope when the architecture supports it.

But an enclave is not simply "fewer licenses."

It creates its own operational requirements.

Employees need to understand where controlled information belongs. Access must be controlled. Data flows have to be documented. Integrations must respect the boundary. Your team has to operate the environment the way it was designed.

An enclave that employees routinely work around is not much of an enclave.

That is why the right question isn't simply:

Which approach costs less?

It is:

Which boundary can we realistically maintain every day?

GCC High is a Microsoft decision—not a synonym for government cloud

This distinction is important.

GCC and GCC High are Microsoft 365 environments.

They are not generic terms for every cloud platform capable of supporting government or defense workloads. Other cloud and technology providers have their own architectures, offerings, contractual commitments, and terminology.

So a conversation about whether an organization needs GCC or GCC High should happen only when Microsoft 365 is part of the proposed CUI environment.

Even then, the platform decision comes after understanding what data Microsoft 365 is expected to handle.

Three questions help clarify the Microsoft 365 decision

Once you have established your scope, the next questions become much more practical.

1. Will your organization receive or transmit CUI through email?

If CUI is going to move through Microsoft Exchange, then your email environment becomes part of the CUI workflow.

That means the environment has to support the requirements created by your contracts and the type of controlled information being exchanged.

2. Will your organization store or transmit CUI through Teams, SharePoint, or OneDrive?

The same principle applies to collaboration.

If employees will use Microsoft 365 services to collaborate on controlled drawings, specifications, documents, or other CUI, those services are participating directly in the CUI environment.

If Microsoft 365 will not handle CUI because that information is intentionally isolated elsewhere, the architecture may look very different.

3. What type of CUI are you handling?

This is where the GCC-versus-GCC High distinction becomes more relevant.

Microsoft states that Microsoft 365 GCC supports FedRAMP High and DFARS requirements, while GCC High adds capabilities and contractual commitments designed for more restrictive defense requirements, including ITAR.

So if export-controlled technical data will travel through Microsoft email, Teams, SharePoint, or related services, GCC High may become the appropriate Microsoft environment.

If the information is not subject to those additional restrictions, GCC may be an option depending on the applicable contract requirements, services being used, configuration, and the organization's overall architecture.

And if Microsoft 365 is not handling the CUI at all, the GCC/GCC High question may not be the central architecture question in the first place.

The enclave decision and the GCC High decision are different decisions

This distinction prevents a lot of unnecessary confusion. You can decide to create an enclave and then determine which technologies should operate inside it.

You can also decide that an enclave creates too much friction and bring a larger portion of the organization into the CMMC boundary.

The enclave decision defines the boundary.

The cloud decision determines how certain workloads inside that boundary will operate.

They influence one another, but they are not the same decision.

Starting with GCC High can reverse that order.

A company buys the environment first, migrates users into it, and then begins asking which people and systems actually needed to be there.

That can turn a compliance project into a much larger IT transformation than necessary.

Cloud providers still have obligations when they handle covered defense information

When an external cloud service provider stores, processes, or transmits covered defense information, DFARS 252.204-7012 requires the contractor to ensure that the provider meets security requirements equivalent to the FedRAMP Moderate baseline and supports specified cyber-incident reporting and related obligations.

Notice what the clause does not say:

It does not tell every contractor to purchase a product called GCC High.

It establishes requirements that the environment handling the information must satisfy.

Microsoft GCC High is one architecture used to address those requirements—particularly where Microsoft 365 and export-controlled information intersect—but it should be the result of the analysis rather than the starting assumption.

The order that holds up

Before committing to an enclave, an enterprise-wide migration, GCC, GCC High, or another compliance platform, work through the decisions in this order:

1. Review your contracts.
Which DFARS clauses, export-control requirements, customer requirements, and prime-contractor requirements apply?

2. Identify the data.
What CUI do you actually receive, create, store, and transmit? Does it include export-controlled or other CUI Specified information?

3. Map the data flow.
Which employees, devices, applications, machines, collaboration tools, and external providers actually touch that information?

4. Define the CMMC scope.
Does the workflow support a defensible enclave, or would an enterprise-wide approach be easier to operate?

5. Choose the architecture.
Determine how email, collaboration, file storage, engineering systems, ERP, manufacturing systems, and other services should interact with the CUI boundary.

6. Select the platforms—with both today's requirements and tomorrow's opportunities in mind.
Only now should decisions such as Microsoft GCC versus GCC High become straightforward enough to defend. But the decision should not be based exclusively on the contracts you hold today. Consider the work the organization expects to pursue next.

That matters because a manufacturer may be able to meet its current requirements using GCC because it does not presently handle CUI Specified such as ITAR-controlled information. If there is a reasonable likelihood that future contracts will introduce those requirements, however, starting with GCC High may avoid a second major migration later.

Moving an organization into GCC already requires planning, migration, configuration, user change, and operational disruption. Moving again from GCC to GCC High means transitioning into a different Microsoft cloud environment and repeating significant parts of that work.

So the question is not simply:

What environment satisfies our requirements today?

It is also:

What environment are we likely to need over the next several years based on the work we intend to pursue?

Paying for capabilities you have no realistic reason to need is wasteful. But saving money today only to repeat an impactful migration when the next defense contract arrives can be even more expensive.

The most expensive compliance environment is often the one you have to build twice.

What about the current CMMC Phase II suspension?

The CMMC timeline has changed, but the importance of correctly protecting CUI has not.

On July 13, 2026, DoD suspended the planned Phase II implementation of CMMC while continuing Phase I self-assessment requirements. DoD also stated that the suspension does not eliminate contractors' obligations to protect covered information under DFARS 252.204-7012.

That makes this a useful time to get the architecture right rather than rush into a technology purchase based on an assumed deadline.

Where Site2 fits

A CMMC readiness conversation should not begin with:

"How many GCC High licenses do you need?"

It should begin with:

"Show us where your CUI comes in, where it goes, and who actually needs it."

From there, Site2 can help determine:

• Which people and systems belong inside the CMMC boundary
• Whether an enclave or broader enterprise approach makes operational sense
• Which cloud and collaboration requirements that architecture creates
• Whether Microsoft GCC, GCC High, or another approach is appropriate
• Whether likely future contract requirements should influence today's architecture
• What controls, documentation, and evidence will be needed to support the environment

The objective is not to build the biggest compliance environment.

It is to build a defensible one that protects the information, supports the way your organization actually works, and can grow with the work your organization intends to pursue.