Government Contractors
Microsoft 365 for Contractors, Commercial or GCC High, Run by a Security Team.
Email carries your proposals, your primes' requests and, in the wrong place, CUI. We secure the tenant you have and run the IT around the enclave your Compliance Division designs. Capital Cyber, based in Leesburg, Virginia, provides Microsoft 365 and Email Security for government contractors and works on-site across Northern Virginia.
For contractors who live in Outlook, Teams and SharePoint and need to know which of it can hold CUI.
Microsoft 365 and Email Security for Government Contractors
Commercial Microsoft 365 or GCC High: Which One Do We Need?
It depends on what you handle. FCI, the non-public information provided by or generated for the government under a contract, is protected at CMMC Level 1 by the 15 requirements of FAR 52.204-21. CUI is a marked category that requires NIST SP 800-171 at Level 2, and where CUI lives matters.
A commercial tenant can be secured well for FCI and business email. For CUI, the question is whether you need Microsoft GCC High and how much of the company has to sit in it.
Who Designs a GCC High Environment?
Our Compliance Division, Capital Cyber Compliance. It designs the CUI enclave and documents it, usually keeping CUI in a defined part of the environment so most of the business stays out of scope. We run the managed IT and security around it.
Microsoft GCC High addresses where CUI is stored and processed. It does not on its own satisfy the 14 control families, which is why the people running the tenant matter as much as the tenant.
How Do You Protect the Commercial Tenant?
Multi-factor authentication on every email account, individual accounts for everyone, and no daily work from administrator accounts. Email filtering and web filtering block known phishing and malware before they reach a person, and anti-spoofing settings make it harder to send mail that looks like it came from your domain.
NIST SP 800-171 asks for access control, authentication and protection of communications. A tenant that is set up securely and stays that way is how those requirements show up in your mailbox.
What About Email Attacks Aimed at Contractors?
Picture a lookalike message that appears to come from a prime, asking for a revised bank detail or a document. A written procedure to verify payment and bank detail changes closes the gap that business email compromise depends on, and staff training makes the last person in the chain a control rather than a target.
What Is Included
6 PARTSTenant Administration
Users, licenses, mailboxes, Teams and SharePoint access, handled by your managed IT team.
MFA on Every Account
Multi-factor authentication on email and business applications.
Email and Web Filtering
Known phishing and malware blocked before it reaches an inbox or a browser.
Email Authentication
Anti-spoofing settings for your domain, so your name is harder to forge.
Least Privilege
Individual accounts for everyone, and no daily work from administrator accounts.
Invoice Fraud Procedure
A written process for verifying payment and bank detail changes.
Frequently Asked Questions
4 QUESTIONSDo we have to move the whole company to GCC High?
Usually not. A CUI enclave keeps CUI in a defined part of the environment so most of the business stays out of scope. Our Compliance Division designs it with you.
Do you design GCC High tenants?
CUI enclave design on Microsoft GCC High is delivered by our Compliance Division, Capital Cyber Compliance. We run the managed IT and security around it.
Is Microsoft 365 secure out of the box for a contractor?
Microsoft provides the tools. Multi-factor authentication, sign-in rules and anti-spoofing settings still have to be turned on, configured and watched. That is the work we do.
Does GCC High make us compliant?
No. It addresses where CUI is stored and processed. It does not on its own satisfy the 14 control families of NIST SP 800-171. Confirm your exact requirements against your contract.
More for Government Contractors
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Government Contractors
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Government Contractors
IT support, managed security and CMMC experience for defense and federal suppliers.
Talk Through Your Tenant.
Pick a time. Tell us what you handle, FCI or CUI, and which Microsoft plan you are on.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.