Is GCC-High required to pass CMMC?

Comparison between commercial and FedRAMP clouds and what they tell us for CMMC Level 2 and CUI compliance, whether we need GCC-High or not

Amira Armond (CMMC Instructor, Certified CMMC Assessor, President Kieri Solutions) answers the question “Is GCC-High required to pass a CMMC assessment?

This is actually an explanation of what the FedRAMP program is and is not.

This video is meant for educational and entertainment purposes only. These are opinions presented in a purposefully simplified format.

Enjoy, and don’t forget to subscribe to our YouTube channel for lots of other CMMC training content.

Link to DoD’s official guidance about evaluating FedRAMP equivalency:

**UPDATED** New guidance was released in January 2024. See DoD memo below for full details.

https://dodcio.defense.gov/Portals/0/Documents/Library/FEDRAMP-EquivalencyCloudServiceProviders.pdf

Note: DoD CIO has since clarified that they are NOT going to curate a list of “FedRAMP equivalent” clouds. Instead, each contractor and each assessor needs to perform the full evaluation each time a cloud vendor is reviewed.

Microsoft’s blog about their cloud tiers and appropriateness for CUI:

https://techcommunity.microsoft.com/t5/public-sector-blog/understanding-compliance-between-commercial-government-and-dod/ba-p/3258326


Amira Armond is the President and Quality Manager for Kieri Solutions, an Authorized C3PAO. Kieri Solutions provides CMMC preparation and Authorized C3PAO assessment services. Check their services out at https://www.kieri.com

Leave a Reply

Your email address will not be published. Required fields are marked *