ITAR compliance for defense contractors: what GCC High does not cover
Geert WarmenbolApril 29, 2026
Key takeaways
Migrating to Microsoft 365 GCC High does not satisfy ITAR compliance. Access controls, MFA enforcement, CUI data flow documentation, and FIPS-validated cryptography must each be separately configured and technically validated.
CMMC Level 2 permits POA&Ms only for controls not yet implemented. Using a POA&M to document a failed control is a compliance violation — C3PAOs apply objective evidence standards, not documentation standards.
AC.L2-3.1.3 (CUI Flow Control) is the most commonly failed control in Vulnox assessments of defense contractors. The failure is not missing policy — it is undocumented CUI movement through collaboration tools and third-party SaaS platforms.
FIPS-validated cryptography under SC.L2-3.13.11 requires NIST-validated modules, not libraries that claim FIPS compatibility. The distinction is invisible until a breach investigation forces decryption review.
ITAR extends beyond CMMC scope. Foreign national access to USML technical data is an ITAR violation regardless of CMMC certification status.
By 2027, Vulnox predicts that supply chain attacks targeting DIB subcontractors will use AI-generated spear phishing to bypass MFA in environments where conditional access policies have not been hardened past vendor defaults.
TL;DR
Defense contractors keep failing ITAR and CMMC assessments for the same reason: they treat platform selection as compliance. GCC High is infrastructure, not a control set. The controls that actually fail — CUI flow mapping, FIPS cryptography validation, access segmentation — are the ones organizations document in their SSP and then never technically test. A clean audit report against a broken environment is not compliance. It is a deferred finding.
The assumption that costs contracts
During an onboarding call with a parts supplier in the F-35 supply chain, the CIO asked: 'I don't get it. We migrated everything to Microsoft 365 GCC High. Shouldn't that automatically make us ITAR compliant?' The question is not unusual. It appears, in some variation, in roughly half of the initial assessments Vulnox conducts with defense contractors who have recently completed a cloud migration. The migration is real. The compliance is not.
GCC High provides a boundary that satisfies data residency and access isolation requirements for US government data. What it does not do is configure access controls, enforce MFA, map CUI data flows, validate cryptographic modules, or segment network traffic. Every one of those is a contractor obligation. The platform is a prerequisite. It is not a substitute for implementation. When a C3PAO shows up to conduct a Level 2 assessment, they are not checking whether you selected the right cloud. They are checking whether the controls inside it work.
What CMMC Level 2 actually measures
CMMC Level 2 maps to NIST 800-171, which covers 110 practices across 14 domains. The assessment methodology used by C3PAOs applies three assessment methods to each practice: examine, interview, and test. A System Security Plan that accurately describes a control satisfies 'examine.' An employee who can explain the control satisfies 'interview.' A live technical test that confirms the control is functioning satisfies 'test.' All three are required for a passing finding. Most contractors optimize for the first two and assume the third follows.
Example
AC.L2-3.1.1 requires that access to CUI be restricted to authorized users based on least privilege. In one aerospace manufacturing assessment, that control was documented in the SSP, employees described it correctly in interviews, and it still failed — because an NFS share containing missile guidance system technical data was accessible to every authenticated user on the domain. The SSP said least privilege. The live environment said full read access for 847 accounts.
The gap between documented intent and live configuration is where most CMMC failures originate. Automated tools can find some of it. Manual validation finds the rest. Neither is optional.
What the assessments actually show
Assessment base: Vulnox assessment data, 2024-2025, defense contractor engagements across aerospace manufacturing, logistics, and SaaS DIB suppliers
CUI moving through undocumented channels
In assessments of mid-size DIB suppliers, Vulnox consistently finds CUI in places the SSP does not mention. Slack channels. Personal OneDrive folders. Salesforce records. Third-party ticketing systems. The CUI flow diagrams submitted to C3PAOs show clean, bounded movement between approved systems. The live environment shows CUI scattered across whatever collaboration tool an employee found convenient.
AC.L2-3.1.3 requires demonstrated enforcement of CUI flow controls, not a diagram that describes what flows should look like. Every undocumented CUI location is both a CMMC finding and an ITAR exposure — because the access logging, encryption, and foreign national restrictions required by ITAR cannot be applied to data the organization does not know exists in that location.
FIPS compliance claimed, FIPS validation absent
SC.L2-3.13.11 requires FIPS-validated cryptography. The NIST Cryptographic Module Validation Program (CMVP) maintains the list of validated modules. Contractors routinely use libraries that advertise FIPS support — OpenSSL FIPS mode, BouncyCastle, Microsoft's built-in cryptography — and assume the advertising satisfies the requirement. It does not. FIPS-validated means the specific build and configuration has received a CMVP certificate. CrowdStrike's endpoint agent is a common example: the cryptographic module may be FIPS-capable but the specific deployment configuration in many contractor environments has not been validated to the standard required by SC.L2-3.13.11.
A breach investigation that triggers a forced decryption review will expose this gap. The contractor believed the data was FIPS-protected. The auditor finds an unvalidated module. At that point, the compliance failure compounds the breach.
POA&Ms used to defer failed controls
CMMC allows POA&Ms for Level 2 assessments, but only for controls that have not yet been fully implemented — not for controls that were tested and failed. Vulnox has reviewed SSPs submitted ahead of C3PAO assessments where POA&Ms were used to document controls that the contractor had implemented, tested internally, and found non-functional. The intent was to signal awareness of the gap. The effect was to formally document a failed control and defer remediation.
C3PAOs do not treat a POA&M on a failed control as a path to conditional certification. They treat it as evidence that the contractor identified a problem and did not fix it before submission. The False Claims Act exposure compounds this — contractors who certify compliance while knowingly deferring failed controls are not in a grey area.
The control that looks covered and is not
Common belief
Contractors who have deployed CrowdStrike Falcon, Microsoft Defender for Endpoint, or similar EDR platforms assume that endpoint protection satisfies a significant portion of CMMC technical controls. The EDR is running. The logs are flowing. The endpoints are covered.
What we found
In assessments where contractors cited EDR as their primary technical control evidence, Vulnox found exposed RDP on 23% of in-scope servers, shared local administrator credentials on 41% of systems, and SMBv1 enabled on at least one system in 67% of environments. The EDR was logging all of it. None of it was being acted on.
EDR deployment satisfies SI.L2-3.14.1 (malicious code protection) and contributes to AU.L2-3.3.1 (audit log generation). It does not satisfy the access control domain, the configuration management domain, or the identification and authentication domain. More importantly, EDR deployment is frequently cited by contractors as a substitute for server hardening. The two are not the same. An EDR agent on a Windows Server 2019 instance with default RDP enabled, local administrator accounts sharing passwords across systems, and SMBv1 still active is an instrumented attack surface — not a hardened one.
What contractors say before the assessment
'We passed our last self-assessment. We scored 110 out of 110 on the SPRS submission.'
Root cause:SPRS self-assessments are scored by the contractor using the DoD Assessment Methodology. The methodology requires honest scoring — but it also relies entirely on the contractor's own judgment about whether a control is implemented. Contractors consistently score controls as implemented based on policy documentation rather than technical validation. A control with a written procedure, no technical enforcement, and no evidence of testing scores as implemented under a lenient self-assessment. It fails a C3PAO third-party assessment immediately.
'Our MSP handles all of this. They're certified.'
Root cause:Managed service providers who handle IT for defense contractors may themselves be CMMC-certified or pursuing certification. That certification covers their own environment — not the contractor's. The contractor's CUI-handling systems, network configuration, access control policies, and SSP are the contractor's responsibility regardless of who manages the infrastructure. When a C3PAO assesses the contractor, they assess the contractor's environment. The MSP's certification is not transferable.
'We don't actually build defense articles. We just make a component that goes into a larger system.'
Root cause:ITAR jurisdiction does not require that an organization build a complete defense article. If a component is on the United States Munitions List, or if the technical data describing how to manufacture that component qualifies as USML technical data, ITAR applies. Components suppliers in the aerospace and defense supply chain frequently underestimate their ITAR exposure because they are three tiers removed from the prime contractor and assume the regulatory burden stays upstream.
What ITAR compliance programs consistently miss
Foreign national access to technical data
CMMC does not address nationality-based access restrictions. ITAR does. A defense contractor with a fully implemented CMMC Level 2 environment can still commit an ITAR violation if a foreign national employee — regardless of visa status or clearance — accesses USML technical data without a DSP-5 export license or an applicable exemption. Contractors with engineering teams that include non-US persons and no formal technology control plan are carrying ITAR exposure that no CMMC control will catch.
Data residency for CUI in collaboration tools
GCC High enforces US data residency for Exchange, SharePoint, and Teams data stored in Microsoft's managed storage. It does not enforce data residency for data that passes through integration connectors, Power Automate flows, or third-party applications that plug into the Microsoft 365 environment. CUI that flows from a Teams channel into a Salesforce record, a Jira ticket, or a GitHub repository may leave the GCC High boundary entirely. The data flow diagrams in most SSPs do not capture this.
Subcontractor access to controlled technical data
Prime contractors are required to flow CMMC requirements down to subcontractors who handle CUI. The mechanism for doing this — contract clauses, subcontractor SSP review, periodic validation — is frequently documented at the prime level and not enforced in practice. Vulnox has reviewed subcontractor environments where the prime contractor had no record of the subcontractor's CMMC posture, no contractual evidence requirement, and no process for verifying that CUI shared with the subcontractor was being handled appropriately. The prime contractor is liable for that exposure.
Where this breaks in the next 24 months
At least one mid-size DIB supplier will face False Claims Act liability specifically for a SPRS self-assessment that scored implemented controls as complete when technical validation would have found them non-functional. The case will not originate from a DoD audit — it will originate from a qui tam relator inside the organization.
The FCA qui tam mechanism allows employees to file on behalf of the government and receive a portion of recovered damages. As CMMC enforcement increases and third-party assessments begin revealing the gap between SPRS scores and actual posture, employees who were involved in self-assessment submissions are in a position to file. The incentive structure is already there. The number of non-functional controls being scored as implemented is high enough that the risk is not theoretical.
Confidence: highA publicly reported FCA settlement citing SPRS self-assessment misrepresentation by a company with fewer than 500 employees, filed by a former employee, before Q4 2027.AI-assisted spear phishing will achieve meaningful credential compromise rates against DIB subcontractors specifically because conditional access policies in GCC High environments are deployed at vendor defaults, not hardened for high-risk authentication scenarios.
Conditional access in Microsoft 365 GCC High requires deliberate configuration to enforce device compliance, restrict legacy authentication, and apply risk-based sign-in policies. The vendor default is permissive. Contractors who completed the GCC High migration with MSP assistance frequently inherit the MSP's default conditional access template, which passes compliance checks but does not block the authentication patterns that targeted phishing attacks exploit. The attack surface is well understood by threat actors — the defense contractor sector is a named target in multiple threat intelligence reports from 2024.
Confidence: highA public breach disclosure from a DIB subcontractor attributing credential compromise to phishing against a GCC High environment with default conditional access policies, before Q2 2027.
The compliance theater problem is structural, not behavioral
The reason defense contractors keep failing CMMC technical assessments after passing self-assessments is not that they are dishonest. It is that the self-assessment methodology rewards documentation over validation. A contractor who has written a thorough SSP, trained employees on the policies, and submitted a detailed SPRS scorecard has done everything the self-assessment process rewarded them for doing. They have done almost nothing to confirm that the controls actually work. The gap between 'we have a policy for this' and 'this control is technically enforced' is where every finding lives. CMMC Level 2 third-party assessment closes that gap structurally, by requiring C3PAO examination of live technical evidence. But the transition from a documentation culture to a validation culture requires organizations to actively seek out evidence that their controls fail — which is uncomfortable, and which no self-assessment process incentivizes.
Counterargument
The counterargument is that small defense contractors genuinely lack the internal resources to conduct rigorous technical validation of 110 CMMC practices, and that expecting them to do so before a third-party assessment is unrealistic. That is true. It does not change what C3PAOs will find. The practical implication is not that the standard should be lower — it is that contractors need external technical validation before the assessment, not documentation review. The distinction matters for how budget gets allocated.
One thing to do this week
Pull your current System Security Plan and find the section on CUI data flows. For each flow documented, verify in the live environment that the technical control enforcing that flow is actually configured and functioning. Do not check the documentation. Check the system. Start with AC.L2-3.1.3 and work outward. Every gap between the SSP and the live environment is both a C3PAO finding waiting to be written and an active ITAR exposure you are currently carrying. The documentation did not create the gap. Only fixing the configuration closes it.
Further Reading
Gap Analysis
framework gap analysisVulnerability Assessment
vulnerability assessmentNational Vulnerability Database NIST
NIST National Vulnerability DatabaseNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkOWASP Web Security Testing Guide
OWASP security testing guide
Frequently Asked Questions
Does migrating to Microsoft 365 GCC High make a defense contractor ITAR compliant?
No. GCC High provides a compliant infrastructure boundary, but the contractor must still configure access controls, enforce MFA, document CUI data flows in a System Security Plan, and technically validate every CMMC control. The platform is a prerequisite, not a substitute for implementation. Vulnox assessments consistently find contractors who completed the migration and then stopped there, leaving CUI accessible to all authenticated users with no segmentation.
What is the difference between a POA&M for a failed control versus a control not yet implemented?
CMMC Level 2 permits Plans of Action and Milestones only for controls that have not yet been implemented — not for controls that were implemented and failed testing. Using a POA&M to document a failed control is a compliance violation, not a remediation path. C3PAOs apply objective evidence standards during assessment; a documented plan does not substitute for demonstrated functionality.
Which CMMC Level 2 control do defense contractors most commonly fail during technical validation?
AC.L2-3.1.3, CUI Flow Control, is the control that generates the most findings in Vulnox assessments of DIB suppliers. The failure pattern is consistent: organizations have CUI moving through collaboration tools, cloud storage, and third-party SaaS platforms that are not documented in any data flow diagram. The control requires demonstrated evidence that CUI flows are mapped and enforced — not just that a policy document says they should be.
How do attackers exploit FIPS cryptography gaps at defense contractors?
The common attack vector is not breaking the encryption — it is finding CUI stored or transmitted by a library that claims FIPS compliance but lacks independent NIST validation. When a national security letter or incident investigation forces decryption review, unvalidated cryptography exposes the data. The CMMC requirement under SC.L2-3.13.11 is FIPS-validated cryptography, not FIPS-compatible. The difference matters in a breach investigation.
What does ITAR require beyond what CMMC Level 2 already covers?
CMMC Level 2 covers protection of CUI within the contractor environment. ITAR adds export control obligations that CMMC does not address: who is allowed to access technical data based on citizenship and nationality, how technology transfer is documented across the supply chain, and what happens when a foreign national employee or vendor touches USML-listed items. A contractor can be fully CMMC-certified and still violate ITAR through an undocumented foreign national access event.
What should a defense contractor do this week to reduce ITAR compliance exposure?
Pull the current System Security Plan and map every CUI data flow listed in it against live system configurations. For each flow, verify that the technical control enforcing it is actually in place — not just documented. Start with AC.L2-3.1.3 (CUI Flow Control) and SC.L2-3.13.11 (FIPS-validated cryptography). Every gap between the SSP and the live environment is a potential C3PAO finding and an active ITAR exposure.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.