Does my organization need GCC High if we handle CUI but are not directly subject to ITAR?

Handling CUI does not automatically require GCC High if the data is not subject to ITAR, EAR, or DFARS 252.204-7012 clauses. The specific regulatory obligation tied to the CUI determines which Microsoft cloud environment is appropriate, not the CUI designation alone.

If your contract includes DFARS 7012 clauses, Microsoft recommends GCC High for CMMC 2.0 Level 2 compliance, even without ITAR applicability. DFARS 7012 requires the use of a cloud service provider with FedRAMP authorization, and GCC High's FedRAMP High certification is the most direct path to meeting that requirement within Microsoft's ecosystem. For CUI that falls under CMMC Level 1 only (handling Federal Contract Information without higher sensitivity requirements), standard GCC or even a properly configured commercial environment may be sufficient. The safest approach is to review the specific CUI category markings on your contract and consult with your contracting officer. If any CUI in your environment is subject to DFARS 7012, ITAR, or requires FedRAMP High cloud hosting, GCC High is the appropriate environment.