Do you need Microsoft 365 GCC High for CMMC?
Picture a defense contractor that handles CUI or ITAR-controlled technical data in Microsoft 365 and must show CMMC Level 2 compliance. Microsoft 365 GCC High is one option for that workload, not a requirement and not a shortcut. Microsoft offers it to contractors holding DoD CUI or subject to ITAR, sells it through Volume Licensing only after an eligibility validation, and does not offer a trial. Buying the environment does not make the organization CMMC compliant, because the tenant is only one part of the system that gets assessed.
The organization still owns its policies, its assessment scope, its configuration choices and the evidence that shows each NIST SP 800-171 Rev. 2 requirement is met. An implementation partner such as DeployOpen can prepare the environment, configure controls and organize evidence in the client's own tenant, but it does not decide scope or certify anything. When a contract requires Level 2 certification, only an independent C3PAO assesses it. Confirm the current certification requirement in your contracts, because the Department of War suspended CMMC Phase II on 13 July 2026, and check the CMMC Program rule for the scoping language that applies to your systems.
Whether GCC High fits depends on your own data flows, not on the product. Map where CUI is created, stored, transmitted and shared, including email, Teams, SharePoint and OneDrive. Identify subcontractors and external partners who will receive that data, because GCC High users can share SharePoint and OneDrive files only with other GCC High organizations. Then review your existing commercial tenant, since migrating CUI into a new tenant is a configuration and scoping project of its own. Ask your candidate partner for a written scope before any work starts, and ask Microsoft to confirm eligibility for your organization.
Who can buy GCC High for CMMC work, and who cannot
Microsoft 365 GCC High is sold to a defined set of organizations after an eligibility validation, and that validation is Microsoft's decision. The cards below set out the four cases most contractors fall into, so you can see where your organization sits before you talk to Microsoft or your contracting office.
Defense contractor holding DoD CUI
Contractors that hold DoD controlled unclassified information (CUI) are the core audience for GCC High. Microsoft describes the environment as available to contractors holding DoD CUI, which matches the CMMC scope where CUI is stored, processed or transmitted. Confirm that your contracts actually involve CUI, since the CMMC scope of your environment depends on it. Ask Microsoft what validation evidence it needs from you before purchase.
Contractor subject to ITAR
Microsoft also offers GCC High to contractors subject to the International Traffic in Arms Regulations (ITAR), even when a contract does not involve DoD CUI. An ITAR obligation can drive the decision to use a U.S.-person environment, so confirm with your export compliance function which data falls under ITAR. Eligibility is still validated by Microsoft, so do not assume that an ITAR classification alone qualifies you.
Non-DoD entity with equivalency or inheritance
A non-DoD entity can buy GCC High if it can demonstrate equivalency to Impact Level 4 or the inheritance needed for CMMC. Microsoft assesses GCC High against NIST SP 800-53 controls at a FIPS 199 High categorization, and your assessor will expect to see which practices come from Microsoft and which remain yours. Ask Microsoft in writing what equivalency evidence it will provide and how your assessor can verify it.
Non-DoD entity without DoD access
A non-DoD entity cannot buy the DoD environment. Only DoD entities may buy the DoD environment certified at SRG Impact Level 5, so a non-DoD organization that needs IL5 scope must look at other options and confirm them with the relevant authorities. Confirm your entity type with Microsoft and your contracting office before purchase, because the validation outcome is Microsoft's call and not something this page can promise.
What Microsoft's CMMC guides cover and where they stop
Microsoft's CMMC materials help you scope inheritance, but they do not certify your environment. The starting point is the FIPS 199 High categorization: Microsoft states that Office 365 GCC High is assessed against NIST SP 800-53 controls at a FIPS 199 High categorization. That tells you how Microsoft's service was evaluated for confidentiality, integrity and availability. It does not show that your tenant configuration, your user population, your CUI handling or your administrative processes meet the 110 NIST SP 800-171 Rev. 2 requirements that Level 2 incorporates. Treat the categorization as one input to your own mapping, and confirm with Microsoft in writing which GCC High assessment artifacts you can share with your assessor.
Microsoft's *Product Placemat* and *Technical Reference Guide* for CMMC show which practices customers inherit from Microsoft cloud services, which are shared and which the customer owns. The same guidance points to the NIST SP 800-171 regulatory compliance initiatives in Azure Policy for Azure and Azure Government. Use these to draft your responsibility split, but check each line against your own tenant. Azure Policy initiatives report configuration state; they do not decide whether a practice is met, and a compliant policy result is not the same as evidence in final form for a specific requirement such as AC.L2-3.1.1.
The Cyber AB's *CMMC Assessment Process* v2.0 requires assessors to check that an external service provider's customer responsibility matrix is current, names all parties with security responsibilities and covers every in-scope requirement the provider performs wholly, partly or jointly. That check is on the provider's matrix, not on your compliance. You must still map each of the 110 Level 2 requirements to your own configuration, identity settings, endpoints, data flows and procedures, and record which ones Microsoft performs, which you share and which remain yours. Requirements Microsoft cannot see, such as your media handling, personnel screening and incident reporting to DoD, will usually sit entirely with you.
Which CMMC practices Microsoft inherits and which you own
Inherited practices are those Microsoft operates in the GCC High infrastructure, so your assessor can rely on Microsoft's documentation instead of testing the control on your side. Microsoft's CMMC guidance for Azure describes a Product Placemat and Technical Reference Guide that identifies these practices. Typical examples include controls over the facilities that host the service, maintenance of the service's underlying hosts and network equipment, and patching of the platform components Microsoft runs. Confirm each inherited requirement ID against the Placemat version you hold, because the mapping is what your assessor will check.
- Facility protection: Physical access, badging and visitor control at the hosting locations sit with Microsoft under its attestation package.
- Infrastructure maintenance: Microsoft maintains the underlying hosts, hypervisors and network devices that run the service.
- Platform patching: Updates to the service components Microsoft operates are Microsoft's duty, although endpoint patching stays with you.
- Equipment sanitization: Sanitizing storage hardware retired from Microsoft's facilities is generally listed as Microsoft's responsibility. Confirm the specific requirement.
Before you rely on any inherited row, check that the Microsoft attestation package you keep on file covers the same service and region you are buying.
Shared practices are ones where Microsoft provides the capability and you configure, operate or evidence it. The Placemat marks these rows so both parties are named. Your System Security Plan has to say which part Microsoft performs and which part your team performs, because an assessor will test your configuration even when the platform supplies the feature. Shared rows are where most contractors lose evidence, since the platform generates logs or settings that nobody has reviewed or retained in the form an assessor expects.
- Identity and MFA: Microsoft supplies the directory and authentication features, while you set the policies, enrollment rules and factor requirements.
- Audit logging: The service generates audit records, while you decide what is enabled, how long records are retained and who reviews them.
- Encryption: Microsoft encrypts service data, while you control the configuration choices, such as FIPS-validated settings and key options where offered. Confirm which options are available in GCC High.
- Boundary and malware protection: Microsoft protects the service boundary, while you protect the endpoints and clients that connect to it.
Check that every shared row in your copy of the Placemat names both parties and that your SSP describes each side with the same wording.
Customer-owned practices stay with the contractor no matter which cloud service hosts the CUI. Microsoft cannot perform them for you, and an assessor will expect your own evidence for each one. These controls depend on your organization's people, policies and tenant decisions. Several of them also depend on how you configure GCC High, so the same feature can satisfy a requirement in one tenant and fail it in another. Build these controls first, then match the evidence to the requirement IDs in the Placemat.
- Identity governance: You own access reviews, joiner and leaver processes, and the conditional access policy design that decides who reaches CUI and from which devices.
- Data protection: You own sensitivity labels, DLP rules for CUI, and sharing decisions inside the tenant. GCC High sharing is limited to other GCC High organizations, so plan external collaboration accordingly.
- Endpoints and monitoring: You own device compliance policies, endpoint configuration, and the review and retention of audit logs.
- Response and people: You own the incident response plan and its testing, plus personnel screening for your own staff who access CUI.
- Documentation: You own the written policies and the System Security Plan that ties every requirement to its evidence.
Before assessment, have someone outside the configuration team test each owned control and confirm the evidence is final, not a draft.
What makes a GCC High CMMC project cost more or take longer
Most of the effort in a GCC High CMMC project comes from how much data, people and systems have to sit inside the enclave, and how many outside parties must be assessed alongside it. The six drivers below decide how big the boundary is and how much evidence you must produce, so scope them before you commit to a tenant design or a timeline.
Users and endpoints touching CUI
Every user account, device and administrator who can reach CUI in GCC High sits inside your assessed scope and must meet the access, identification and configuration requirements. Count the people who open CUI in email, SharePoint, OneDrive and Teams, plus the endpoints they use, including unmanaged or personal devices. Ask whether engineering, sales or executive staff truly need access, because each extra group adds licenses, device management and evidence.
External sharing limits for suppliers
GCC High users can share SharePoint and OneDrive files only with other GCC High organizations. Suppliers and partners on commercial Microsoft 365 cannot receive files through those links, so you must agree on a workflow before the tenant is designed. Options include a separately assessed transfer enclave, managed file transfer that your system security plan covers, or requiring suppliers to join GCC High. Each option changes the number of parties in scope.
Commercial features missing in GCC High
Some commercial features are not available in GCC High, including PSTN calling and Viva Engage for enterprise. Teams that rely on them will need an alternative, such as a separate calling provider or a different collaboration tool, and that alternative may handle CUI and therefore enter scope. Inventory the features each department uses before you commit, and confirm current availability in Microsoft's service description rather than relying on older guidance.
Non-Microsoft tools that handle CUI
Backup products, ticketing systems, code repositories, password managers, PDF signing services and line-of-business applications become part of scope once they store, process or transmit CUI. Each one needs its own assessment of security practices and, where it is a service provider, its own evidence under the customer responsibility matrix. Map every integration that touches CUI early, and decide whether to host it inside the boundary or remove it from the CUI flow.
Maturity of identity and logging
Teams with mature identity governance, conditional access, phishing-resistant multifactor authentication and centralized audit logging can map existing evidence into GCC High quickly. Teams starting from shared accounts, manual user reviews or unmonitored logs will need to build those practices first, which adds design work and a period of collecting evidence over time. Review your current identity provider, admin roles and log retention against the requirements before you estimate the project.
Subcontractors and service providers in scope
Each subcontractor or external service provider that stores, processes or transmits CUI, or that could affect the security of the CUI environment, must be identified and its responsibilities documented. Under the assessment process, an external service provider's customer responsibility matrix must be current and cover every requirement it performs in whole, in part or jointly. Ask each provider early for its evidence, and agree which party owns each requirement in writing.
What you pay for and who gets paid
This table compares each cost component of running CMMC on Microsoft 365 GCC High by who is paid, whether the cost is one-time or recurring, and what moves it up or down. Use it to separate what Microsoft licenses, what an implementation partner scopes, what your own staff carries, and what an independent assessor charges, then request separate written terms from each party. Fees for Microsoft licensing and assessors are set by those parties, so ask for their terms directly.
| Cost component | Who is paid | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Microsoft 365 GCC High subscriptions | Microsoft, through a Volume Licensing agreement | Recurring, per user | Seat count, license tiers and add-ons you select; eligibility must be validated before purchase, and trials are not available |
| Implementation partner scoping and configuration | DeployOpen or another implementation partner, under a written scope | One-time, fixed scope | Number of enclaves, tenants and identity integrations, data migration volume, and how much CUI handling is in scope |
| System Security Plan and policy writing | Implementation partner, consultant or internal staff | One-time, then periodic updates | Number of systems in scope, how current the existing documentation is, and how often the environment changes |
| Identity and logging tooling used alongside the tenant | Tool vendor, or your team if self-hosted | Recurring (licenses, hosting, support) | Whether you reuse existing identity and SIEM platforms or add new ones, and whether licenses are commercial or open source |
| Internal staff time | Your own employees | Ongoing | Size of your IT and security team, admin workload for access reviews, and frequency of evidence collection |
| Remediation through a Plan of Action and Milestones | Implementation partner, internal staff or service providers doing the fixes | One-time per gap | Number and complexity of open gaps at assessment, and whether requirements are fixed before the assessment rather than tracked afterward |
| Independent C3PAO assessment, where a contract requires certification | The assessor (C3PAO), and assessment fees are set by the assessor | Periodic, per assessment cycle | Scope size, number of sites and systems assessed, and assessor availability; confirm current requirements, as Phase II certification is suspended |
| Ongoing monitoring and affirmations | Internal staff, and implementation partner if on retainer | Recurring | Frequency of control monitoring, changes to the environment, and the annual affirmation workload for the Affirming Official |
How a GCC High CMMC project moves from eligibility to assessment
This sequence takes a defense contractor from confirming it may buy Microsoft 365 GCC High to holding evidence, a posted SPRS result and, where a contract requires it, an independent assessor's report. Each step produces a named artifact that the next step depends on.
Confirm eligibility through Microsoft validation
Before any design work, confirm that the organization qualifies for Microsoft 365 GCC High. Microsoft offers the environment to the US Department of Defense and to contractors that hold DoD CUI or are subject to ITAR, and it is sold through Volume Licensing after an eligibility validation process. Trials are not available, so plan around a licensed purchase. The output is an approved Volume Licensing purchase path, which you confirm in writing with your Microsoft account team or licensing partner.
Define the CUI boundary under the scoping rule
Under the CMMC scoping rule in 32 CFR 170.19, identify every asset that processes, stores or transmits CUI, plus the assets that provide security protection for those assets. Map how CUI enters, moves through and leaves the tenant, including email, SharePoint, OneDrive, Teams, endpoints, identity providers and any third-party tools. The output is a data flow diagram and an asset list that both the security team and the assessor can read. Confirm the boundary with your contracting office and an assessor before you configure anything.
Configure the tenant and map responsibilities
Configure the GCC High tenant and its connected services to match your boundary, then map each Level 2 requirement to one of three owners: inherited from Microsoft, shared with Microsoft, or owned by your organization. Microsoft's CMMC Product Placemat and Technical Reference Guide show which practices fall into each group, and Azure Policy includes NIST SP 800-171 regulatory compliance initiatives for Azure and Azure Government. Your customer responsibility mapping and configuration baseline are complete when every in-scope requirement has an owner, a setting and a named person who maintains it. Note that Microsoft's guidance supports your mapping but does not replace it.
Build evidence and draft the System Security Plan
Collect the artifacts that show each requirement is met: policies, configuration exports, access reviews, audit log samples, training records, incident procedures and scan results. Assessors assess against the NIST SP 800-171A objectives, and a requirement counts as MET only when all applicable objectives are satisfied with evidence in final form, not drafts. Draft the System Security Plan in parallel, describing the environment, the boundary, the inheritance decisions and how each control operates. The output is an evidence library indexed to the requirement IDs, with each item dated, owned and approved.
Complete the self-assessment and post to SPRS
Complete a Level 2 self-assessment against the 110 requirements of the CMMC Level 2 model, scoring each requirement against the evidence library and recording any open items on a plan of action where the rules allow. Post the resulting score to the Supplier Performance Risk System (SPRS) and complete the affirmation that an Affirming Official signs. The Department of War said on 13 July 2026 that Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The output is a current SPRS entry and a signed affirmation, both of which you should confirm against the latest DoD guidance before submission.
Undergo a C3PAO certification assessment if required
Where a specific contract still requires a Level 2 certification, engage a C3PAO authorized or accredited by The Cyber AB to perform the assessment. The Department of War suspended CMMC Phase II on 13 July 2026, so this step applies only where a contract still requires it. Confirm the current requirement with the contracting office before scheduling. The assessor, not your implementation partner, reviews your evidence and issues the assessor report. Your role is to provide evidence in final form, the System Security Plan and access to the tenant, while the assessor decides the outcome independently.
GCC High, commercial Microsoft 365, or Azure Government: which fits
This table compares four hosting options for CUI under CMMC and shows what you still own in each. Read each row against your actual data flows, because the platform that fits depends on where CUI is created, stored, processed and transmitted, not on which vendor you prefer. Confirm each option against current DFARS 252.204-7012 and CMMC scope rules with your contracting office before you commit.
| Option | When it fits | What you still own |
|---|---|---|
| Microsoft 365 GCC High | Contractors holding DoD CUI or ITAR data that need the Microsoft collaboration suite (email, SharePoint, OneDrive, Teams) inside one government tenant. Eligibility is validated before purchase. | Tenant configuration, identity and MFA, device management, sharing rules, logging retention, and every control Microsoft lists as customer responsibility in its CMMC guidance. |
| Microsoft 365 commercial with CUI controls | Only where your assessment scope and contract explicitly allow CUI in a commercial tenant. Treat this as a special case, not a default. CUI handling in commercial tenants requires its own assessment and must be confirmed with the contracting office. | Everything in scope for the tenant, plus proof that the commercial configuration meets the applicable requirements, documented in your SSP and assessed on its own terms. |
| Azure Government for custom workloads | Custom applications, data platforms or engineering systems that process CUI, where productivity suite needs are handled separately. Microsoft states Azure Government holds FedRAMP High and DoD IL5 provisional authorizations. | Workload configuration, key management choices, identity, network boundaries, logging, and the customer side of Microsoft's responsibility matrix. Productivity tools need their own decision. |
| On-premises or hybrid enclave | Organizations where Microsoft 365 is not the CUI platform, or where CUI must stay in a boundary you control, such as engineering networks or specialized assets. | The full scope of physical, network, endpoint, identity and monitoring controls, plus any external service providers that touch the enclave and their customer responsibility matrices. |
What usually delays GCC High CMMC work
Most delays in GCC High CMMC projects come from assumptions made before the environment is built, not from the platform itself. The five cards below cover the decisions and evidence gaps that cost the most time, and each one names a check to run early.
Treating inheritance as proof
Microsoft's Product Placemat and Technical Reference Guide for CMMC show which practices customers inherit, which are shared and which the customer owns. Inherited practices still need an assessor to verify the cloud service's attestation, and shared practices need your own configuration evidence. Map the Placemat against your system security plan in the first weeks of the project, and mark every line where you are the only party responsible. A customer responsibility matrix that is out of date or silent on a shared practice is a common finding.
Moving users before scoping CUI flows
Teams often move mailboxes and file shares into GCC High before deciding which CUI flows must stay there. Under the scoping rule in 32 CFR 170.19, the systems that store, process or transmit CUI and the security protection assets that protect them are in scope, and everything else should be kept out. Build a data flow diagram that lists each CUI source, recipient and storage location first. Then decide which users and workloads belong in the enclave, and confirm that non-enclave users cannot reach CUI through shared sites or mail forwarding.
Finding missing features after purchase
Some commercial Microsoft 365 features are not available in GCC High. Microsoft's service description names PSTN calling and Viva Engage for enterprise as examples, and the list changes over time. Discovering a gap after rollout can force a second tool, a workaround that moves CUI outside the boundary, or a delayed cutover. Before purchase, list every workflow your staff depend on, including telephony, collaboration, third-party add-ins and mobile access, and check each against the current GCC High service description. Record the result in writing and ask the reseller to confirm it.
Relying on drafts and screenshots
Assessors test each requirement against the assessment objectives in NIST SP 800-171A, and a requirement is MET only when all applicable objectives are satisfied with evidence in final form, not drafts. Screenshots taken on the day of a review, unsigned policies and undated exports are weak evidence because they cannot show the control operated over time. Store policies with version history and approval records, keep configuration exports from a repeatable script, and retain logs for the period the assessor will sample. Confirm with your assessor which evidence formats they accept before you collect it.
Confusing Phase II with Phase I duties
On 13 July 2026 the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. A GCC High tenant does not remove these duties. Confirm with your contracting officer and counsel which obligations apply to each contract, keep your SPRS score and affirmation current, and check the DoW CIO page for the current implementation status, since guidance on the eCFR text and the CIO site has differed.
Questions buyers ask about GCC High and CMMC
Does Microsoft 365 GCC High alone satisfy CMMC?
No. GCC High is a cloud service, and Microsoft's assessment covers its own infrastructure, not your organization. Your company still owns the controls that sit with you, such as user access reviews, device configuration, incident handling, personnel screening and policy. Under the CMMC Level 2 model, which mirrors the 110 requirements of NIST SP 800-171 Rev. 2, you must assess each requirement against its assessment objectives and keep final evidence for every one that applies. Microsoft's Product Placemat and Technical Reference Guide for CMMC show which practices are inherited, which are shared and which remain yours. Use that matrix as a starting point, then check each shared practice against your own configuration. Ask a qualified advisor to confirm the split for your specific tenant and boundary.
How long does a GCC High migration take?
There is no fixed duration, and any number you hear should be treated with caution until it is tied to your environment. The main drivers are the amount of CUI in scope, the number of users and devices, how many integrations connect to mail, file sharing and identity, and how many third parties need access to the enclave. Eligibility validation through Microsoft's process also adds lead time before you can buy the service. Migration work includes tenant design, identity and MFA setup, data classification, moving content, retiring commercial tenants or segregating data, and writing the system security plan. Ask any provider for a written plan that lists these phases and the assumptions behind each one.
Can our internal team do the GCC High and CMMC work?
Yes, if your team has the time and skills to do it. The work involves mapping the 110 Level 2 requirements to your tenant, endpoints, networks and processes, configuring the controls, and producing evidence in final form that an assessor can verify. Many teams underestimate the documentation effort, particularly the system security plan, policy set and evidence that shows controls operate over time. Internal staff are also needed for daily operations, which can compete with a migration project. A common approach is to keep ownership of policies and decisions in-house while bringing in outside help for configuration, testing and evidence preparation. Be aware that DeployOpen prepares systems and evidence but does not issue assessments or certifications.
What do we need to provide for a GCC High engagement?
Plan to provide four groups of people and access. First, administrative access to the Microsoft 365 tenant and the identity provider, so configuration can be set and tested. Second, owners of each CUI data flow, who can explain where controlled information is created, stored, shared and deleted. Third, policy owners for access, incident response, personnel security, media handling and change control, who can approve the written rules your assessor will read. Fourth, an executive sponsor who can settle scope disputes, approve budget and accept residual risk. Some engagements also need access to endpoint management, network devices and backup systems. Define these needs in the written scope before work starts so delays do not surface late in the project.
Does Microsoft's US-citizen screening apply to our staff?
No. Microsoft's screening requirements apply to Microsoft personnel who request temporary elevated access to customer content in GCC High, including US citizenship verification, seven-year employment and criminal history checks and fingerprinting. They do not decide who on your payroll may access CUI. Your own organization still owns the personnel security requirements in CMMC, which require you to screen individuals before they receive access to systems with CUI and to protect those systems during terminations and transfers. Your screening standard should be written into policy, applied consistently, and documented so an assessor can verify it. Confirm with your contracts team whether any contract clause imposes additional citizenship or clearance requirements on your staff.
Who issues the CMMC Level 2 certificate for GCC High?
Only a C3PAO, a third-party assessment organization authorized or accredited by the CMMC Accreditation Body, issues a Level 2 certification, and it does so only when a contract requires one. Microsoft does not issue your certificate, and neither does DeployOpen. Under current CMMC rules, Level 2 self-assessments remain available for contracts that call for them, and the Department of War has suspended the Phase II certification requirement while it reviews the program. Check the contract clause, the current status published by the DoW CIO and your contracting officer before you plan the assessment type. Your self-assessment results and SPRS entries remain obligations in the meantime.
How DeployOpen prepares a GCC High environment for CMMC
DeployOpen works on the parts of a CMMC environment that the organization configures and evidences, including the controls it still owns inside Microsoft 365 GCC High. We scope the work in writing first, then build, test, document and hand over the environment so your team and your independent assessor can verify it.
How we scope
- Confirm which GCC High services, users and data flows hold or touch CUI before any build begins
- Map each Level 2 requirement to the inherited, shared or customer-owned responsibility shown in Microsoft's CMMC guidance
- Agree scope, deliverables and timelines in a fixed-scope written statement of work before work starts
How we build
- Configure identity, MFA, conditional access, audit logging and device settings in your GCC High tenant to match your system security plan
- Harden the self-hosted open-source tools that sit alongside GCC High, such as logging, scanning and time sync, within your own infrastructure
- Test each configured control against the NIST SP 800-171A assessment objectives and record gaps before they reach an assessor
How we hand over
- Deliver the system security plan, customer responsibility matrix entries and configuration baselines in final, reviewable form
- Document evidence for each requirement so your assessor can trace a configuration to its artifact without interviewing a project team
- Transfer administration, runbooks and access to your staff so the environment operates without DeployOpen in the loop
How we support
- Keep the system security plan and evidence current as Microsoft services, DoW guidance and your contracts change
- Run upgrades, backups and periodic control testing under a retainer agreed in writing
- Confirm with your C3PAO or assessor, and with Microsoft, which responsibilities each party holds before each assessment
