What types of organizations are required to use GCC High?

Organizations required to use GCC High include DoD contractors holding CUI, companies subject to ITAR or Export Administration Regulations (EAR), Defense Industrial Base firms pursuing CMMC Level 2 or higher certification, and federal agencies that need FedRAMP High Impact authorization for their cloud workloads.

Specific sectors where GCC High is common include aerospace and defense (manufacturers of aircraft, spacecraft, weapons systems, and related components), advanced manufacturing (companies producing materials or parts), defense technology (firms building cybersecurity tools, communication systems, or classified software), defense research (universities and labs conducting DoD-funded work), and military healthcare (organizations managing health records for active-duty personnel or veterans). The common thread is the regulatory obligation, not the organization's size or revenue. A 50-person subcontractor making circuit boards for a defense program has the same GCC High requirement as a large prime contractor if both handle CUI under a DFARS 7012 clause.