For Defense Contractors, Copilot in GCC High Uses Existing CUI Permissions
New York, NY, Oct. 27, 2026 (GLOBE NEWSWIRE) -- CMMC Level 2 covers the 110 security requirements in NIST SP 800-171 Revision 2, and access control is among them.¹ eSoftware Associates (ESW) advises defense contractors to map which controlled unclassified information (CUI) proposed users can open before licensing Microsoft 365 Copilot, and to confirm the cloud environment and current CMMC terms that govern that data.
“Moving to GCC High doesn’t automatically mean the right people have access to the right files. You still need to review permissions inside your tenant,” said Russell Kommer, founder and CEO of eSoftware Associates.
What each control decides
| Control | What it does | Where it stops |
| Cloud environment (GCC or GCC High) | Sets where CUI is stored and which compliance commitments apply | Does not decide who inside the tenant can open a file |
| User permissions | Determine what Copilot can surface for each signed-in user | Permissions broader than intended carry into Copilot responses |
| Sensitivity-label encryption | Restricts who can open a file | For encrypted files, Copilot can return content to users who hold both VIEW and EXTRACT rights |
Match the cloud to the workload
Cloud selection depends on the CUI categories and applicable contract clauses, including DFARS 252.204-7012 and relevant export-control requirements. Microsoft positions GCC High for organizations that handle CUI or whose contracts require DFARS, ITAR or EAR compliance. Contractors planning a Microsoft 365 GCC High deployment should settle that choice before licensing Copilot.
ESW’s GCC High work includes feature analyses that compare standard SharePoint with GCC High, showing what changes when content moves into the government cloud. ESW, a 100% U.S.-based Microsoft partner, has completed more than 200 migrations into Microsoft 365 GCC and GCC High with zero data loss.
Review CUI permissions before licenses are assigned
The access review should cover CUI in program sites, shared mailboxes and Teams channels, including access held by people outside the program. Applying sensitivity labels with encryption to CUI adds a second limit on who can open it. ESW’s Microsoft Copilot consulting services include SharePoint cleanup, security configuration and governance policy creation.
Confirm current CMMC assessment requirements
On July 13, 2026, the Department of War announced that it had suspended the CMMC Phase II requirements, originally scheduled for Nov. 10, 2026, pending a review of the program.² Contractors still need to meet the CMMC terms in their existing solicitations and contracts.
Frequently Asked Questions
Question: Is Microsoft 365 Copilot available in GCC High?
Answer: Yes. Microsoft offers Microsoft 365 Copilot in GCC, GCC High and DoW environments, where it operates within the customer’s government cloud tenant. Feature availability differs by environment, and some features available in the commercial cloud may not be available in GCC High. Compare Microsoft’s GCC High feature list with the workflows the contractor plans to support.
Question: Which CMMC assessment should a contractor plan for?
Answer: The level follows the information involved: Level 1 for Federal Contract Information only, Level 2 for CUI and Level 3 for the most sensitive CUI. The solicitation or contract specifies the level and whether a self-assessment or third-party assessment applies. Because of the Phase II suspension, reconcile those terms, including amendments, with current department implementation guidance before commissioning an assessment, and keep protecting CUI in the meantime.
Question: Can Copilot be kept away from CUI?
Answer: Restricting who can open CUI and excluding CUI from Copilot processing are separate controls. Microsoft Purview data loss prevention policies for the Microsoft 365 Copilot location can exclude files and emails with specified sensitivity labels from Copilot processing, although those items may still appear in citations. Encryption alone does not provide that exclusion. Confirm that these controls are available in GCC High and configured for the intended content before rollout.
Defense contractors planning a Copilot rollout can review ESW’s AI readiness assessment.
¹ 32 CFR Part 170, Cybersecurity Maturity Model Certification Program.
² U.S. Small Business Administration, July 13, 2026.
About eSoftware Associates (ESW)
ESW builds secure business apps, workflows, portals, and automations across Power Apps, SharePoint, Dataverse, SPFx, Copilot & AI Agents, and Azure. 100% U.S.-based since 2006.
Majed Soufi Zen Media pr@zenmedia.com
Legal Disclaimer:
EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
