What is a Government Cloud Enclave
A government cloud enclave is an isolated cloud environment, usually built in Microsoft 365 GCC High, Azure Government, or AWS GovCloud, where all of your CUI lives and all CUI work happens. Defense contractors need one when they handle Controlled Unclassified Information and want to meet DFARS 7012 and CMMC Level 2 without bringing their entire company into scope.
Last updated: October 2026
What makes an environment a government enclave
Commercial cloud platforms are built for flexibility and broad access. A government enclave is built around restriction. It is a defined boundary, and everything inside it is held to your CMMC controls.
An environment counts as a government cloud enclave when it has:
- A government cloud foundation. FedRAMP Moderate or equivalent at minimum for CUI under DFARS 7012. GCC High, Azure Government, and AWS GovCloud carry FedRAMP High.
- U.S. data residency and restricted support access. Data stays in the United States, and provider personnel are screened.
- An enforced boundary. Identity, device, and network controls keep CUI inside and keep everything else out.
- Documentation that matches. Your SSP, asset inventory, and network diagram all describe the same boundary.
GCC vs GCC High, Azure Government, and AWS GovCloud
Most enclaves combine a productivity suite with infrastructure. Here is when each environment fits CUI.
| Environment | What it is | Fit for CUI | Best for |
|---|---|---|---|
| Microsoft 365 GCC | Microsoft 365 for government customers, with U.S. data residency and screened personnel | Possible for some non-export-controlled CUI, case by case; not for ITAR or EAR data | Federal contract information (FCI) and lighter CUI needs where the contract allows it |
| Microsoft 365 GCC High | A separate Microsoft 365 cloud built for DoD contractors, with access limited to screened U.S. persons | Strongest Microsoft 365 fit for CUI, including ITAR and EAR data | Email, Teams, SharePoint, and OneDrive for contractors handling CUI |
| Azure Government | Microsoft’s government infrastructure cloud, physically separate from commercial Azure | Yes, for supported services; FedRAMP High | Servers, applications, virtual desktops, and data workloads, especially in Microsoft shops |
| AWS GovCloud (US) | AWS regions isolated for U.S. government and regulated workloads, operated by U.S. persons | Yes, for supported services; FedRAMP High | Linux, container, compute-heavy, and AWS-native workloads |
Scroll the table sideways on a phone to see every column.
GCC or GCC High?
GCC High is the usual choice for defense contractors with CUI. It supports DFARS requirements and ITAR data, and Microsoft recommends it when CUI lives in Microsoft 365.
GCC can work for federal contract information and some non-export-controlled CUI, but it cannot hold ITAR data. Let your contracts and data types decide. Our GCC High vs GCC vs Commercial comparison walks through it, and migrating commercial Microsoft 365 to GCC High covers the move.
Where Azure Government and AWS GovCloud fit
GCC High handles email and collaboration. If you also run servers, line-of-business apps, engineering tools, or virtual desktops with CUI, they belong in Azure Government or AWS GovCloud. GCC High runs on Azure Government infrastructure, but they are separate services you buy and manage separately.
See AWS GovCloud explained for defense contractors and Azure Government vs AWS GovCloud to compare.
How an enclave reduces your CMMC assessment scope
Under 32 CFR Part 170, your CMMC Level 2 assessment covers the assets that process, store, or transmit CUI, the assets that protect them, and anything not separated from them. Everything in that boundary must meet the 110 requirements in NIST SP 800-171 Rev 2.
An enclave lets you draw that boundary on purpose. When all CUI work happens inside the enclave, the assessment covers the enclave and the security tools that support it. The rest of your corporate network can stay out of scope, which means less to build, document, and defend.
Encryption alone does not create separation
You still need to encrypt CUI in transit and at rest. But encryption by itself does not take systems out of scope. The separation has to be enforced with identity, device, and network controls that actually stop CUI from leaving the enclave.
A sync client that copies files to unmanaged laptops, a shared admin account, or permissive firewall rules can all pull the wider network back into scope. For the full breakdown of asset categories, see CMMC scoping explained: what counts as in scope.
What lives inside a government cloud enclave
Think of the enclave in layers. Each one supports a set of NIST SP 800-171 requirements and needs both technology and documented process.
| Layer | Typical tools | What it does for compliance |
|---|---|---|
| Identity and access | Microsoft Entra ID, MFA, Conditional Access, privileged access controls | Controls who gets in, from which device, and with what rights |
| Endpoints | Microsoft Intune, Defender for Endpoint, or a locked-down virtual desktop | Keeps only managed, hardened devices touching CUI |
| Collaboration and data | Exchange, Teams, SharePoint, and OneDrive in GCC High, with sensitivity labels | Keeps CUI in a compliant place with clear handling rules |
| Network boundary | Firewalls, private connectivity, and data loss prevention policies | Stops CUI from flowing out of the enclave |
| Monitoring and response | SIEM such as Microsoft Sentinel, vulnerability scanning, and an incident response plan | Provides the audit trail and 72-hour incident reporting readiness DFARS 7012 expects |
| Configuration management | Baselines aligned to DISA STIGs or CIS benchmarks, and change control | Shows the environment stays configured the way your SSP says it is |
Keeping the enclave compliant
Standing up the enclave is step one. Keeping it compliant is ongoing work, and this is where many organizations underestimate the effort.
- Monitor logs and alerts every day, not just before an assessment
- Patch and scan for vulnerabilities on a regular schedule
- Hold configurations to a baseline such as DISA STIGs
- Keep your SSP, asset inventory, and network diagram current
- Train users on how to handle CUI inside the enclave
- Test your incident response plan against the 72-hour reporting deadline
The 110 Level 2 requirements span 14 families, including access control, audit and accountability, configuration management, incident response, media protection, and system and communications protection. Each needs evidence an assessor can examine, test, or confirm in an interview.
2026 update: where CMMC stands
CMMC Phase 1 began November 10, 2025, adding Level 1 and Level 2 self-assessment requirements to applicable contracts. Phase 2, which would have required Level 2 third-party certification from a C3PAO starting November 10, 2026, was suspended by the Department of War on July 13, 2026 while a reform task force reviews the program.
That does not mean you can wait. These still apply:
- DFARS 252.204-7012 and its requirements for safeguarding CUI and reporting incidents within 72 hours
- NIST SP 800-171 Rev 2 for systems that handle CUI
- Level 1 and Level 2 self-assessments, with scores posted in SPRS
- Annual affirmations by a senior official
- Prime contractors’ right to require certification before sharing CUI
An enclave helps on every one of these, because it gives you a smaller, clearly defined environment to secure, score, and affirm. For how the contract clauses fit together, see our DFARS 7012, 7019, 7020 and 7021 cheat sheet.
When a defense contractor needs an enclave
- You receive or create CUI, such as technical drawings, specifications, or export-controlled data
- Your contracts include DFARS 7012 or a CMMC Level 2 requirement
- Only part of your workforce touches CUI, so moving the whole company would cost more than it needs to
- CUI is currently in commercial Microsoft 365, personal email, or file-sharing tools that do not meet FedRAMP Moderate or equivalent
- A prime has asked for your SPRS score, SSP, or certification status
Why VSO
VSO has designed, built, and managed secure government cloud environments for defense and federal clients since 2017. Our veteran-led team brings real DoD and federal experience, and we are CMMC Level 2 certified.
We work across GCC High, Azure Government, and AWS GovCloud, including IL4 and IL5 environments, with cleared personnel available when your contracts require them and experience supporting 75+ sites across CONUS, OCONUS, and SCIF environments.
We also scope exactly what you ask for. Some clients want us to run the enclave long term. Others want it built right and handed back to their own team, and we do that too. Learn more about our CMMC services.
Frequently asked questions
Ready to build your enclave?
Do not wait until a contract requires it. Talk to the VSO team for an honest look at where your environment stands and what it takes to get compliant and stay compliant. Call (888) 805-0510, email sales@vso-inc.com, or request an enclave review.
About the author
Ethan Watts is the VP of Commercial and Channel Business at VSO, where he leads sales and delivery across dozens of successful contracts and engagements. He works closely with clients and partners to develop and achieve their IT goals.
