Whitepaper · July 2026

GCC High, brought low.

Microsoft 365 GCC High carries a FedRAMP High authorization. According to public reporting, reviewers could not verify fundamental aspects of its security architecture, including where data was encrypted in transit. This paper examines what the public record actually shows, and what agencies and contractors should ask now.

Download the Whitepaper →Follow the 12-week series

Get the paper

What the public record shows

FedRAMP reviewers reportedly spent years seeking data-flow diagrams showing where GCC High encrypted data in transit, and received a general white paper instead
Only two services, Exchange Online and Teams, were reportedly fully examined before authorization
Microsoft's third-party assessor was placed on a corrective action plan by FedRAMP
ProPublica reported China-based engineering support for U.S. government cloud customers
Microsoft's own documentation places GCC High support outside the service accreditation boundary
The cost, migration, and feature-gap burden GCC High imposes on defense contractors

Whitepaper

GCC High Brought Low

Five problems the label does not disclose, with the public record behind each one.

Three fields. No cost.

The findings

Five problems the label doesn't disclose

The encryption question

Encryption in transit is basic cloud evidence. A white paper describes intent. A data-flow diagram shows reality. Public reporting says reviewers asked for the diagram and got the white paper.

Sections 1–2 of the paper

The assessor problem

Assessors are hired by the vendors they assess. In this case, FedRAMP reportedly placed Microsoft's assessor on a corrective action plan for not pushing back harder. The validation layer itself drew concern.

Section 4

Too embedded to reject

Public descriptions suggest reviewers felt authorization could not practically be withheld because agencies already depended on the system. Adoption controlled certification, instead of the reverse.

Section 5

The support boundary

Microsoft's own documentation warns that GCC High support sits outside the accreditation boundary and carries no FedRAMP, ITAR, or DoD SRG data-handling assurances. The platform is not the whole system.

Section 6

Cost more, do less

Substantially higher licensing, a full tenant migration to get in, and documented feature gaps versus commercial Microsoft 365. The premium buys the label, and the label is what's in question.

Section 8

The alternative: purpose-built

A secure enclave should be architected as a secure enclave, not retrofitted from a general-purpose productivity ecosystem. Architecture first. The compliance package follows from it.

See the RegDOX CCE →

Follow along

The 12-week series

One finding per week on the RegDOX blog, from the FedRAMP promise through the questions every contractor should be asking. The first installments:

Week 1

Why Proof Matters

The central problem in plain terms: authorization for highly sensitive government use despite reportedly unverifiable architecture.

Week 2

The FedRAMP Promise

"Do once, use many times" only works if the once is rigorous. Certification should control adoption, not the reverse.

Week 3

The Encryption Question

A white paper is not a data-flow diagram. What reviewers asked for, what they reportedly received, and why the difference matters.

This analysis is based entirely on publicly reported information, and the whitepaper includes Microsoft's public responses to the reporting it discusses.