GCC High and CMMC Enclaves
GCC vs GCC High, CUI Enclaves, and CMMC Level 2 Scope Under DFARS 7012
CMMC Phase 2 is paused, but DFARS 252.204-7012 still applies and Level 2 still means 110 requirements. Get your enclave or GCC High tenant through us: we scope it with you, the providers that build them price it, and we negotiate the contract.
Scope My EnclaveThe pause changed when third-party certification arrives, not what has to be protected. So the first decision is where the CUI actually goes. Draw that boundary well and the scope is a defined group of users and the systems around them; draw it badly and every mailbox, laptop and file share that has held a controlled drawing is in scope. We scope the environment with you and put it in front of the providers that build and run compliant environments, as part of our managed security services practice.
Sources: DoD CIO, About CMMC (Phase 2 suspension, 110 requirements) and WilmerHale (scope of the pause); 32 CFR 170.21 (80 percent minimum, 180 days); 32 CFR 170.17 (three years, annual affirmation).
CMMC Phase 2 Status: Where the Rollout Stands
Phase 1 self-assessments are in effect, Phase 2 third-party certification is paused, and Phases 3 and 4 are on hold. The timeline shows each milestone; what the pause did and did not change follows below it.
32 CFR Part 170 takes effect: the three levels, assessment scoring, scoping and the four-phase plan.
In forceLevel 1 or Level 2 self-assessment as a condition of award where the contract requires it, with scores in SPRS and an affirmation every year.
In effectLevel 2 certification by a C3PAO as a condition of award. Suspended pending the DoD review, with no new date. C3PAO assessments remain available voluntarily.
PausedC3PAO certification for option periods, Level 3 assessments by DoD, then CMMC in all applicable contracts. Held with the other later milestones.
On holdSources: 32 CFR Part 170 final rule and phase definitions in 32 CFR 170.3(e); Phase 1 date from the DFARS final rule, as summarized by Cooley; suspension from DoD CIO, About CMMC and WilmerHale; voluntary C3PAO assessments from the Secureframe CMMC news tracker. Figures as of October 2026. Free to cite with a link to this page.
The same CUI inventory, user count and boundary go to the providers that build and run compliant environments, at once, so the quotes compare line by line.
Once you have asked a provider for pricing directly, that provider usually will not register an advisor on the deal, and you negotiate alone. If you have already spoken to one provider, tell us which; we can still run the rest of the market.
The customer responsibility matrix, the FedRAMP Moderate evidence for any cloud that holds CUI, and the incident reporting terms, in writing before you sign.
The provider you choose pays us, so it costs you nothing. If the work is a paid engagement, we tell you the fee before it starts. You'll hear back within 24 hours.
What the July 2026 pause did and did not change
The CMMC program rule, 32 CFR Part 170, took effect December 16, 2024 and set out four phases in section 170.3(e), each beginning one calendar year after the one before it. Phase 1 started November 10, 2025, the effective date of the companion DFARS acquisition rule, and it remains in effect.
On July 13, 2026, the Department of War (the Department of Defense's secondary name since September 2025) suspended Phase 2, which had been scheduled for November 10, 2026, and put the later milestones on hold. Memos from the Department's Chief Information Officer and the Under Secretary for Acquisition and Sustainment limit contracting officers to Level 1 (Self) and Level 2 (Self) and direct them to remove C3PAO and DIBCAC requirements from existing contracts at the next modification or option, as WilmerHale summarized.
A CMMC Reform Task Force is reviewing the program from top to bottom. Its 60-day review closed September 11, 2026, with no report or new Phase 2 date published by early October 2026, per the Secureframe CMMC news tracker, which also records Class Deviation 2026-O0025 Revision 3 of September 3, 2026, carrying the pause into contract text, and the Cyber AB's July 15 statement that C3PAO assessments remain available to organizations that want them. The program rule itself remains in the Code of Federal Regulations.
What did not change: DFARS 252.204-7012 still requires NIST SP 800-171 on systems that hold covered defense information, a cloud equivalent to FedRAMP Moderate for CUI stored outside, and cyber incident reports within seventy-two hours. The Justice Department also still pursues NIST SP 800-171 gaps under the False Claims Act: a $2,042,518 settlement with an aerospace contractor, announced September 1, 2026, resolved allegations about one network, with no determination of liability.
GCC vs GCC High: What Each Microsoft 365 Environment Is For
Microsoft 365 GCC High is one of three Microsoft 365 environments a defense contractor might use; a fourth, DoD, is for the exclusive use of the Department of Defense. The differences that matter to a contractor are who each one is offered for, what Microsoft commits to in writing, and how it is bought. This table sticks to what Microsoft's own documentation says.
| Point of comparison | Commercial Microsoft 365 | GCC | GCC High |
|---|---|---|---|
| Who it is offered for | Businesses generally | US federal, state, local and tribal governments, and contractors holding or processing data on behalf of the US government | The Department of Defense and contractors holding or processing DoD CUI or subject to ITAR |
| Eligibility check | None | Validated before the environment is built, and again at each renewal | Validated before the environment is built, and again at each renewal |
| Compliance Microsoft lists | Not part of Microsoft's US government cloud offerings | FedRAMP High, DFARS, criminal justice (CJI) and federal tax (FTI) data | DoD Security Requirements Guide (designed to Impact Level 4 controls), DFARS and ITAR; assessed against NIST SP 800-53 at FIPS 199 High |
| ITAR contract language | No | No | Yes, the only environment where Microsoft agrees to it |
| Where content is stored | Under Microsoft's general data residency terms | At rest only in datacenters physically located in the US | At rest only in datacenters physically located in the US |
| Microsoft staff access | Not covered by the government screening terms | No standing access; temporary access only for staff who passed background checks, including US citizenship verification | No standing access; temporary access only for staff who passed background checks, including US citizenship verification |
| How it is bought | Commercial licensing channels | Enterprise Agreement, AOS-G partners, MPSA, web direct or CSP | Enterprise Agreement through a licensing solution partner, or AOS-G partners; CSP is not listed |
| Trials | Available | US government entities only | Not available |
| Feature availability | The standard commercial feature set | Listed service by service in Microsoft's government service descriptions | Listed service by service; some features are not offered, including Viva Engage and Shifts |
Sources: Microsoft Learn service descriptions for Office 365 US Government (updated September 29, 2026), GCC and GCC High and DoD; Microsoft 365 Government, how to buy; Microsoft DFARS offering (Impact Level 4 design). Pages checked October 2026; Microsoft updates them, so confirm current terms with the seller.
Send us the DFARS and ITAR clauses in your contracts and how many people handle CUI. We scope it with you and put it in front of the providers that build both environments, before anyone quotes licenses. You'll hear back within 24 hours.
What Is a CUI Enclave?
A CUI enclave is a segmented environment that holds controlled unclassified information, separated physically or logically from the rest of the company, so that only the enclave and the systems that protect it fall inside the CMMC Level 2 assessment. CUI itself is, in the National Archives' definition, information that requires safeguarding or dissemination controls under law, regulation or government-wide policy but is not classified. The scoping rule is what makes an enclave work: under 32 CFR 170.19, assets that cannot process, store or transmit CUI and do not provide security protections for the assets that do, or that are physically or logically separated from those assets, are out of scope and not assessed. The contractor must be ready to justify why each one cannot handle CUI, and an asset that fits any in-scope category cannot be treated as out of scope.
Scope categories and the virtual desktop example follow 32 CFR 170.19; the layout is a Metro Colo Advisory illustration, not a template for any one company. Free to cite with a link to this page.
The rule sorts every asset into five categories, and the category decides what the assessor does with it. Work through this table before anyone prices anything.
| Asset category | In Level 2 scope? | What the assessor does |
|---|---|---|
| CUI assetsProcess, store or transmit CUI | Yes | Assesses them against all Level 2 requirements; they must appear in the asset inventory, the system security plan and the network diagram |
| Security protection assetsProvide security functions to the scope | Yes | Assesses them against the requirements relevant to the capabilities they provide |
| Contractor risk managed assetsCould handle CUI but are not intended to | Yes | Reviews the system security plan; a limited check is allowed if the documentation raises questions |
| Specialized assetsIoT, operational technology, government furnished and test equipment | Yes | Reviews the system security plan; not assessed against the other requirements |
| Out-of-scope assetsCannot handle CUI, or are separated from CUI assets | No | Nothing, but the contractor must be ready to justify why each one cannot process, store or transmit CUI |
Source: 32 CFR 170.19, Table 3, CMMC Level 2 asset categories.
What CMMC Level 2 Requires
CMMC Level 2 is assessed against the 110 security requirements in NIST SP 800-171 Revision 2. NIST published Revision 3 in May 2024, but the CMMC rule ties Level 2 to Revision 2, so that is the version the assessor uses. The maximum score is 110, and each requirement not met subtracts 1, 3 or 5 points, per 32 CFR 170.24.
Under 32 CFR 170.21, a Level 2 assessment with open items, self-assessment or C3PAO, can still produce Conditional status if three things hold: the score is at least 80 percent of the maximum, 88 points (MCA calculation: 0.8 × 110); every open item is a 1-point requirement, the one exception being encryption that is in place but not FIPS-validated; and none is on the rule's short list of requirements that can never be left open. A closeout assessment must then confirm the items closed within 180 days, or the Conditional status expires.
Contracting officers check status in the Supplier Performance Risk System (SPRS) before award. A self-assessment score goes into SPRS directly, with an affirmation of continuing compliance every year; a C3PAO's results reach SPRS through the CMMC assessment system. Since the July 13, 2026 pause, contracts call for Level 2 (Self) rather than Level 2 (C3PAO), and a C3PAO assessment is available to contractors that want one.
Source: DoD CIO, About CMMC: Level 1 is the 15 requirements in FAR 52.204-21, Level 2 the 110 in NIST SP 800-171 Revision 2, Level 3 the 24 selected from NIST SP 800-172 on top of a Final Level 2 certification. The Level 3 total of 134 is an MCA calculation (110 plus 24). Figures as of October 2026. Free to cite with a link to this page.
CMMC Enclave vs Whole-Company GCC High Migration
There are two ways to put CUI into a compliant Microsoft environment: move the whole company into a new GCC High tenant, or build an enclave for the people who handle CUI. Neither is right by default.
| Factor | CUI enclave | Whole-company GCC High migration |
|---|---|---|
| What is in scope | The people and systems that handle CUI, plus the tools that protect them | Every user, mailbox, device and file share in the tenant |
| Daily work | CUI users work in a second environment, often with a second account or a virtual desktop | One environment for everyone |
| Licensing | Government licenses only for the people inside the enclave | Government licenses for everyone |
| Risk of CUI spreading | Real: CUI emailed or saved outside the boundary pulls those systems into scope | Low, because everything is already inside |
| Feature differences | Felt only by the enclave users | Felt by the whole company |
| Usually fits | CUI concentrated in one program, team or engineering group | CUI runs through most of the business, or most staff touch it |
The answer sets your licensing bill and your assessment scope for years. Send us your headcount and who handles CUI, and the providers that fit price both options side by side. If the work is a paid engagement, we tell you the fee before it starts.
Types of CMMC Level 2 Enclave
Enclaves come in several forms, and providers specialize. The right one depends on where your CUI lives and what your people do with it.
GCC High enclave tenant
A separate GCC High tenant for the people who handle CUI, while the rest of the company stays in commercial Microsoft 365. CUI email, Teams and files live there and nowhere else.
Full GCC High migration
The whole company moves into a new GCC High tenant. Mail, files, identities and devices move across, and every connected app is reconnected or replaced. See cloud migration services.
Virtual desktop enclave
CUI stays in hosted desktops in a compliant cloud. Users connect from ordinary laptops configured to pass only keyboard, video and mouse, which the rule treats as out of scope.
Managed enclave service
A provider builds and runs a ready-made CUI environment and hands over a customer responsibility matrix showing which requirements it covers and which stay with you.
Colocation or private cloud enclave
For CAD workstations, file servers and manufacturing systems that cannot move to a cloud: a segmented environment in compliance colocation or on managed private cloud.
Secure file and email enclave
A narrower environment for exchanging CUI with primes and suppliers, for companies whose CUI mostly arrives and leaves as files. The cloud behind it still has to meet the FedRAMP Moderate equivalent requirement.
Whatever the type, the security tools around the enclave are in scope for the capabilities they provide. Continuous monitoring through SOC as a service, endpoint response through managed detection and response, the boundary itself through managed firewall services, and remote access through SASE all belong in the same scope document, and each needs to support the incident reporting the DFARS clause requires, within seventy-two hours of discovery.
GCC High Requirements and GCC High Licensing
Microsoft checks eligibility before it builds a GCC High environment. According to its US Government service description, validation confirms that the organization handles ITAR data, criminal justice data or other government-regulated data, and may require proof of registration with the US State Department for ITAR or sponsorship by a government entity. The how-to-buy page lists the channels.
| Step | What Microsoft's documentation says | What to have ready |
|---|---|---|
| Eligibility validation | Required before the environment is established | Contracts or solicitations carrying DFARS 252.204-7012, your ITAR registration if you hold one, or a government sponsor |
| Buying channel | Enterprise Agreement through a licensing solution partner, listed for 500 seats and up, or an AOS-G partner, listed for under 500 seats | The seat count for the enclave or for the whole company |
| Plans | Office 365 Government plans G1, G3, G5 and F3, with feature availability noted per environment | The features your CUI users need, checked against the GCC High notes |
| Trials | Not available for GCC High | A pilot plan inside the real tenant |
| Renewal | Eligibility revalidated at each renewal | The same evidence, kept current |
Sources: Microsoft Learn, Office 365 US Government, GCC High and DoD and Microsoft 365 Government, how to buy. Microsoft's pages set no seat minimum and list no prices.
GCC High Cost: What Makes Up the Total
Microsoft's how-to-buy page publishes no GCC High prices and licenses are sold through its government channels, so we do not print a license number. What drives the total is the scope, because almost every line below grows with the number of people and systems inside it.
| Cost line | What it covers | What moves it |
|---|---|---|
| Licenses | Government plans per user per month | Enclave or whole company; plan level |
| Migration | Mail, files, Teams, identities and devices into a new tenant | Users, data volume, and how many apps connect to the old tenant |
| Apps that touch CUI | Replacing or re-hosting tools that will hold CUI in a cloud meeting the FedRAMP Moderate equivalent requirement | How many SaaS tools hold CUI today |
| Endpoints and access | Managed devices or virtual desktops for the people in scope | Device count; virtual desktops or managed laptops |
| Monitoring and response | Logging, a security operations center and incident response that can report to DoD within seventy-two hours | Around-the-clock coverage; in-house or managed |
| Documentation | System security plan, policies and the providers' customer responsibility matrices | How much each provider supplies ready-made |
| Assessment | Your own self-assessment work, plus a C3PAO's fee if you choose certification, under a contract you hold directly with the assessor | Size of the scope and how ready it is |
Send it to us before you request quotes. We put the same scope in front of the providers that fit and compare the totals line by line. The provider you choose pays us, so it costs you nothing, and you'll hear back within 24 hours.
Where Azure Government Fits
GCC High covers Microsoft 365: email, Teams, SharePoint and OneDrive. Servers, databases and line-of-business applications that hold CUI need an infrastructure cloud that meets the same FedRAMP Moderate equivalent requirement, such as Azure Government. Microsoft's CMMC guidance says most defense industrial base contractors are best aligned with Azure Government, citing contractual commitments to store customer data in the United States and to limit access to screened US persons, while noting that the need for CMMC certification is not by itself the deciding factor.
A cloud is not the only answer. Systems that need to stay on dedicated hardware can sit in compliance colocation in markets close to defense customers, such as Washington DC, Northern Virginia and Maryland, joined to the cloud side through private data center connectivity. The colocation pricing guide and data center cost pages carry the market rates for that side.
Backups and recovery copies count too. A backup that holds CUI stores CUI, so backup as a service and DRaaS for the enclave have to meet the same cloud requirements as the enclave itself.
GCC High Migration and Enclave Mistakes to Avoid
Most expensive problems in an enclave or GCC High migration start before any provider is involved.
Drawing the boundary before tracing the CUI
Follow the data first: the contracts and primes that send it, the inboxes it lands in, the drawings, the ERP and quality systems that hold it, the suppliers it goes back out to. The boundary goes around what that trace finds.
Treating GCC and GCC High as the same thing
Both are government environments, but Microsoft agrees to ITAR contract language only for GCC High. For CUI without ITAR, get in writing which paragraphs of DFARS 252.204-7012 the environment's terms cover.
Assuming a product makes you compliant
No cloud, enclave or email service carries a CMMC certification for you. CMMC status belongs to the contractor's assessed environment; a provider covers its share through a customer responsibility matrix, which 32 CFR 170.19 requires.
Forgetting the apps around Microsoft 365
CRM, product lifecycle, ticketing, e-signature, file transfer and backup tools that will hold CUI each need a cloud meeting the FedRAMP Moderate equivalent requirement, or they stay outside the enclave and away from CUI.
Leaving the IT provider out of scope
A service provider that is not a cloud provider but handles your CUI or security data is assessed as part of your assessment. Your help desk and outside IT firm are in the scope document whether you planned for them or not.
Planning to fix gaps after the assessment
Conditional status, for a self-assessment or a C3PAO assessment, needs a score of at least 80 percent, only 1-point requirements (plus one encryption exception) can be left open, and they must be closed within 180 days or the status expires. Build the enclave so it meets the requirements, then score it.
Treating the Phase 2 pause as a reprieve
The pause moved third-party certification, not the obligations. DFARS 252.204-7012, the Level 2 self-assessment and the yearly affirmation in SPRS still apply, and an affirmation that does not match the environment is exposure under the False Claims Act. Scope the enclave for the self-assessment you sign today.
How We Place a CMMC Enclave or GCC High Tenant
How many people handle CUI, where it lives today, the contracts that carry DFARS 252.204-7012 or the CMMC clause, whether ITAR data is involved, your current Microsoft 365 setup and the date you need to be ready.
Enclave or whole company, which type of enclave, what stays out and how that will be justified, and which surrounding services (monitoring, endpoint response, firewall, backup) belong in the same scope.
Managed GCC High and enclave providers, virtual desktop, compliance hosting and security operations providers quote the same scope on the same day, with their customer responsibility matrices attached.
Price, migration terms, incident reporting commitments, the responsibility split and exit terms, settled before signature. The provider you choose pays us, so it costs you nothing.
Some work is better done as a paid engagement: scoping a footprint across several sites, or reviewing the CUI environment of a company you are buying. That runs through our IT infrastructure consulting, data center consulting and data center due diligence practices. If the work is a paid engagement, we tell you the fee before it starts.
GCC High and CMMC Enclaves: Frequently Asked Questions
What is GCC High?
GCC High is Microsoft's US government cloud environment for Microsoft 365, offered to Department of Defense contractors that hold or process DoD controlled unclassified information or data subject to ITAR. Microsoft validates eligibility before it builds a GCC High environment, stores customer content at rest only in US datacenters, and agrees to ITAR contract language only for GCC High. It is designed to DoD Impact Level 4 controls and assessed against NIST SP 800-53 at a FIPS 199 High categorization.
What is the difference between GCC and GCC High?
GCC is Microsoft's government cloud for federal, state, local and tribal agencies and contractors handling government data, with FedRAMP High, DFARS, criminal justice and federal tax data among its listed compliance offerings. GCC High is offered for defense contractors handling DoD CUI or ITAR data, is designed to DoD Impact Level 4 controls, uses its own sign-in and service addresses, and is the only one of the two where Microsoft agrees to ITAR contract language. GCC can be bought through more channels, including CSP, while GCC High is sold through an Enterprise Agreement or AOS-G partners.
What is a CMMC enclave?
A CMMC enclave, also called a CUI enclave, is a segmented environment that holds controlled unclassified information, separated physically or logically from the rest of the company. Only the enclave, the people and devices that use it, and the security tools that protect it fall inside the CMMC Level 2 assessment. Everything outside is out of scope, provided the contractor can justify why it cannot process, store or transmit CUI.
Do I need GCC High for CMMC Level 2?
Not by name: the CMMC rule does not require any particular product. It does require a cloud provider holding CUI to meet the FedRAMP requirements in DFARS 252.204-7012: security equivalent to the FedRAMP Moderate baseline, plus the clause's incident reporting and related paragraphs. GCC High is the Microsoft 365 environment Microsoft offers for DoD CUI and ITAR data. Whatever environment you consider, get in writing which paragraphs of the clause its terms cover, or keep CUI in an enclave on another platform that meets them.
What are the GCC High requirements?
Eligibility, validated by Microsoft before the environment is built. Validation confirms that you handle ITAR data or other government-regulated data, and it may require proof of registration with the US State Department for ITAR or sponsorship by a government entity. Eligibility is revalidated when the contract renews, and trials are not available.
How does GCC High licensing work?
GCC High licenses are sold only through Microsoft's government channels: an Enterprise Agreement through a licensing solution partner, which Microsoft lists for 500 seats and up, or an AOS-G partner for under 500 seats. Microsoft's how-to-buy page lists CSP as a channel for GCC but not for GCC High. An enclave needs licenses only for the people inside it, while a whole-company migration needs them for everyone.
How much does GCC High cost?
Microsoft does not publish GCC High prices on its how-to-buy page and its partners quote them, so the reliable number is a quote for your seat count. The total is more than licenses: it includes migration into a new tenant, the third-party apps that touch CUI, devices or virtual desktops, monitoring, documentation and any C3PAO assessment fee. An enclave limits most of those lines to the people who handle CUI.
What does a GCC High migration involve?
Moving into GCC High means moving into a new tenant in a separate cloud, with its own sign-in and service addresses, not switching a license on an existing tenant. Mail, files, Teams, identities and devices move across, and every app connected to the old tenant is reconnected or replaced with one that can hold CUI.
What is CMMC compliant email?
No email service is CMMC certified on its own, because CMMC status belongs to the contractor's assessed environment. Email that holds CUI has to run in a cloud that meets the FedRAMP Moderate equivalent requirement and the incident reporting terms of DFARS 252.204-7012, and it has to be configured and documented as part of your Level 2 scope. For a Microsoft 365 user that usually means GCC High, the environment Microsoft offers for DoD CUI; otherwise it means an email service inside an enclave that meets those terms.
When does CMMC Phase 2 start?
It has no start date. Phase 2, which would have made Level 2 certification by a C3PAO a condition of award from November 10, 2026, was suspended on July 13, 2026 while a Department of War task force reviews the program, and no new date had been published as of early October 2026. Phase 1 continues: Level 1 and Level 2 self-assessments as a condition of award where a contract requires them, with annual affirmations in SPRS.
Does the CMMC Phase 2 pause change whether I need GCC High?
No. GCC High and enclave decisions rest on DFARS 252.204-7012 and ITAR, which the pause did not change: a cloud that stores CUI still needs security equivalent to the FedRAMP Moderate baseline and the clause's incident reporting terms. The pause changed when third-party certification is required at award, not what has to be protected, and a well-scoped enclave makes both today's self-assessment and any later C3PAO assessment smaller.
What is an SPRS score?
It is the summary score from a contractor's NIST SP 800-171 DoD Assessment, posted in the Supplier Performance Risk System, which DoD contracting officers check before award. DFARS 252.204-7019 requires a current assessment for each covered contractor information system relevant to the offer, meaning not more than three years old unless the solicitation sets a shorter period. Under CMMC, self-assessment results are entered in SPRS, and certification results reach SPRS from the CMMC assessment system.
Who performs the CMMC Level 2 assessment?
Under Phase 1, the contractor does: contracts call for a Level 2 self-assessment, entered in SPRS with an affirmation every year. A Level 2 certification assessment is performed by an authorized or accredited CMMC Third-Party Assessment Organization, a C3PAO, which you engage directly; it is no longer required at award while Phase 2 is paused, but it remains available to contractors that want one. We are not a C3PAO or a Registered Practitioner Organization, and we do not assess, certify or promise compliance.
What does Metro Colo Advisory charge?
Nothing for a placement: the provider you choose pays us, so it costs you nothing. If the work is a paid engagement, such as scoping a multi-site footprint or reviewing a target's CUI environment in a transaction, we tell you the fee before it starts. You'll hear back within 24 hours of sending the requirement.
Scope Your Enclave Before You Request Quotes
Send what you know: who handles CUI, where it lives, the contracts that carry the clause and whether ITAR data is involved. Rough numbers are fine. You'll hear back within 24 hours from the person who will run your search. Everything runs by email, so there is no sales call to book.
Once a provider has priced you directly, it usually will not register an advisor on the deal, and you negotiate alone. If you have already spoken to one provider, tell us which; we can still run the rest of the market. The provider you choose pays us, so it costs you nothing.
Security services: managed security services, SOC as a service, managed detection and response, managed firewall services and SASE and SD-WAN.
Cloud and hosting: cloud migration services, managed private cloud, compliance colocation, hybrid cloud colocation and cloud repatriation.
Recovery: backup as a service, DRaaS and disaster recovery colocation.
Defense markets: Washington DC colocation, Virginia data centers, Maryland data centers and data center connectivity.
Advisory: IT infrastructure consulting, data center consulting, data center due diligence and the colocation pricing guide.
