The CSP must be assessed by an approved third-party assessment organization (3PAO).4 security control baseline for moderate or high impact levels. The CSP meets all the security control requirements, including mobile archiving and call archiving, as prescribed by FedRAMP and described in the National Institutes of Standards & Technology (NIST) 800-53, Rev.The cloud service provider (CSP) has the rights as an Agency Authority to Operate (ATO).Following are the key requirements for FedRAMP compliance: The Cloud First Policy formulated in the US advises all federal agencies to use FedRAMP as a framework for assessing and monitoring cloud services. Initiated by the Office of Management and Budget (OMB), the Federal Risk and Management Program (FedRAMP) is a cyber security risk management program that delivers a standard approach for the purchase, use, and security of cloud products and services used by U.S. Finally, GCC High is applicable to the Defense Industrial Base (DIB), Federal Agencies, and DoD contractors. The only difference between DoD and GCC High for Microsoft 365 solutions is that the GCC High exists in its own sovereign environment and does not offer features such as Calling Plans, Compliance Manager, and Defender ATP, etc. Principally, no contractors or outside personnel have access to the data that resides in this cloud environment. Although identical to GCC High, the target audience and applicability differs when it comes to 365 DoD. The Government tier of Microsoft 365 focused on the United States Department of Defense is DoD. The Microsoft GCC solutions are available for use by private organizations and government agencies that aspire to comply with regulations such as FedRAMP, CMMC, and DFARS 7012.

The Microsoft Office 365 Government Community Cloud (GCC) is a cloud-based solution powered by Azure Government, with data centers in the continental United States (CONUS) to help organizations ensure compliance with cybersecurity regulations and federal laws. With this, enterprise instant messaging software has become an imperative for the associated organizations. Office 365 GCC solutions are now FedRAMP High SAR ( read more). Microsoft 365 Government compliance solutions (GCC and GCC High) are designed for organizations handling controlled unclassified information (CUI) on behalf of the US Government.

Microsoft office for federal employees