# Contractors Assess GCC High Backup Options

A procurement-focused discussion compared backup options for CUI and ITAR data in Microsoft 365 GCC High and Azure Government, naming AvePoint, Commvault, Druva, and native Microsoft services. A commenter reported that Microsoft 365 Backup is unavailable in GCC High, while participants questioned whether backups held in separate Azure availability zones or geo-zones provide sufficient independence. The discussion does not establish that any named solution meets ITAR or export-control requirements, so buyers should validate each solution against their specific workloads and security obligations.

- Obtain written, workload-specific confirmation of applicable CUI, ITAR, and export-control support before selecting a backup provider; the discussion does not verify any vendor’s compliance.
- Assess backup isolation, access controls, and recovery capabilities, including whether the proposed availability-zone or geo-zone arrangement provides the independence the organization requires.
- Microsoft 365 Backup’s reported unavailability in GCC High may affect product selection; procurement teams should confirm service availability for their specific GCC High and Azure Government workloads.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cloud Services, Cybersecurity
**Published:** October 15, 2026

### Government Entities
- Federal Risk and Authorization Management Program (FedRAMP)

### Vendors
- AvePoint (incumbent)
- Commvault (incumbent)
- Druva ()
- Microsoft ()

### Key Quotes
> The former FedRAMP high baseline included US persons requirements in the organizationally defined parameters. Those parameters have been tossed out.
> — Community commenter

### Sources
- [M365 & Azure Govt backup of CUI and ITAR data](https://www.reddit.com/r/CMMC/comments/1x6nq4f/m365_azure_govt_backup_of_cui_and_itar_data) - reddit-cmmc