Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
Three platforms come up in almost every conversation about where to keep Controlled Unclassified Information (CUI): Microsoft 365 (commercial, GCC, or GCC High), Box Enterprise in its government configuration, and PreVeil. All three can play a role, and each fits a different situation. For contractors planning CMMC IT in Guam or Hawaii who do not handle ITAR or NOFORN data, Intech Pacific's recommended approach is commercial Microsoft 365 paired with PreVeil Gov Community, with CUI stored and shared in PreVeil. For ITAR or NOFORN data, we recommend GCC High. Box is a fair alternative where external collaboration on large files drives the decision. Whichever you choose, the decision matters more over five years than over five months.
What Each Platform Is Designed to Do
Microsoft 365 GCC and GCC High
- Built for U.S. public sector and defense workloads. GCC High runs on Azure Government and is operated by screened U.S. persons.
- FedRAMP authorized. Microsoft makes its DFARS 252.204-7012 commitments for its government clouds and makes no DFARS 7012 claim for commercial Microsoft 365.
- Includes Exchange Online, SharePoint, OneDrive, Teams, and the Office apps.
- Includes the security stack: Entra ID for identity, Intune for devices, Defender for threat protection, and Purview for data protection.
- The contractor still owns obligations such as the 72-hour incident report to the DoW.
Microsoft 365 can be used to achieve CMMC Level 2 compliance when it is paired with PreVeil Gov Community. Commercial Microsoft 365 handles everyday email and files, and CUI is stored and shared in PreVeil. Because Microsoft does not extend its DFARS 7012 commitments to commercial Microsoft 365, CUI does not live in the commercial tenant. We recommend GCC High for ITAR or NOFORN data.
Box Enterprise (government configuration)
- Box reports FedRAMP High authorization and DoD Impact Level 4 authorization.
- Integrates with Microsoft 365, Okta, and Salesforce.
- Strong at external collaboration: granular sharing controls, watermarking, link expiration, content governance, and audit trails.
- A good fit for sharing large CAD files or drawings with subcontractors and vendors.
PreVeil
- PreVeil Gov Community is an encrypted email and file platform that runs alongside commercial Microsoft 365 or Google Workspace and works with Outlook and File Explorer.
- Users keep their existing email addresses and get a separate encrypted channel for CUI.
- PreVeil states that it stores data in AWS GovCloud, is FedRAMP Moderate equivalent, uses FIPS 140-3 validated cryptographic modules with end-to-end encryption, and supports DFARS 252.204-7012 paragraphs (c) through (g).
- PreVeil states that it includes a Compliance Accelerator with a pre-filled SSP, a customer responsibility matrix, and policy templates.
- It is not a full work environment. It relies on the rest of your IT stack for identity, device security, and everyday collaboration.
What Microsoft 365 and Box Contribute
Microsoft 365 provides encrypted email, file storage, and collaboration, with encryption at rest and in transit, and GCC and GCC High are FedRAMP authorized. Box covers external sharing scenarios that go beyond what SharePoint does well. In a commercial tenant paired with PreVeil, Microsoft 365 still supplies the identity, device, and security stack that the CUI environment depends on.
Identity and endpoints matter on every platform. Entra ID provides MFA, conditional access, and role-based access. Intune makes sure the device opening CUI is patched, encrypted, and configured to your baseline. No storage platform protects CUI if a user's laptop is compromised, because CUI is decrypted on the endpoint to be read. The DoW CIO's CMMC FAQ also states that encryption alone does not create logical separation and that encrypted CUI is still CUI. Your identity and endpoint controls still have to be in place and in scope.
Microsoft Purview adds sensitivity labels, data loss prevention, eDiscovery, records management, and unified audit logs. Box Shield adds anomaly detection, and Box Governance adds retention and legal holds for content outside the Microsoft boundary.
How Platform Choice Affects CUI Scope for CMMC IT in Guam
Assessors trace how CUI moves. The fewer places it can go, the easier the boundary is to defend.
Each model draws the boundary differently. Commercial Microsoft 365 with PreVeil keeps CUI in one designated platform while everyday work stays in the commercial tenant. Microsoft plus Box means one primary ecosystem and one specialized document platform. GCC High puts email, files, and CUI in one government tenant. A clear boundary matters even more for CMMC Guam programs, where local support is limited and every extra platform needs someone on island to run it.
Any model with more than one place for data asks users to know which one to use. With PreVeil, users work in a separate mailbox and file space for CUI. With Box, they decide which files go to Box and which stay in SharePoint. In my experience, that decision point is where mistakes happen: a CUI attachment forwarded from the wrong mailbox, or a file saved to the desktop after download. Each of those mistakes pulls more systems into scope. Clear CUI marking, training, and an SSP that describes how CUI flows between platforms keep that risk manageable.
Cost and Long-Term Fit
PreVeil is often positioned as the lower cost option compared with migrating to a government cloud. Pairing it with an existing commercial Microsoft 365 tenant avoids a tenant migration and government cloud licensing for every user.
Long-term cost depends on more than licenses. Microsoft 365 licensing covers email, collaboration, identity, device management, endpoint protection, data loss prevention, and compliance reporting. Any added platform, whether PreVeil or Box, brings its own training, help desk load, and assessment evidence. Compare the full three-to-five-year cost of each model, including the endpoint and logging tools you need either way.
Cost estimates from 2026 vary widely. The Department of War has estimated roughly $102,000 in total compliance cost for a small contractor, while an SBA estimate cited by CSIS in July 2026 put it near $594,000. The platform you choose is one of the biggest drivers of where you land in that range.
Practical Recommendations for Defense Contractors
- ITAR, export-controlled, or NOFORN data: anchor the CUI environment on Microsoft 365 GCC High, with Azure Government for virtual desktops and enclave infrastructure.
- Other CUI: pair commercial Microsoft 365 with PreVeil Gov Community. Everyday email and files stay in Microsoft 365, and CUI is stored and shared in PreVeil.
- Heavy external collaboration: add Box where you need watermarking, link expiration, or controlled sharing with subcontractors who are not on your tenant.
- CUI currently in a commercial Microsoft 365 tenant: move the CUI into PreVeil and document how it flows between the two platforms. Plan a move to GCC High only if you handle ITAR or NOFORN data or your contract or prime requires it. Moving between clouds is a migration, and a scoped enclave lets you move only the people who need it. Identity and endpoint controls still have to be addressed for every user and device that touches CUI.
- Already on GCC High: the tenant is designed to hold CUI, so the remaining question is usually whether Box is needed for external collaboration.
Where PreVeil Fits
PreVeil fits best when a company wants to keep commercial Microsoft 365 for everyday work and put CUI in a dedicated, separately protected platform. It suits small and mid-size teams, and it avoids a tenant migration. Intech Pacific uses Microsoft 365 with PreVeil as its recommended approach for CUI that is not ITAR or NOFORN. For ITAR or NOFORN data, we recommend GCC High instead.
The trade-offs are practical. Users work in a separate app and workflow for CUI. Identity, endpoint, and logging controls still have to be in place for every user and device that touches CUI, and the SSP has to describe how CUI flows between Microsoft 365 and PreVeil. You also take on a dependency on one more vendor. PreVeil does not make a company compliant on its own, and neither does any other platform. For more on why no single platform passes an assessment by itself, see The DIY CMMC Trap.
Does the 2026 Pause Change the Platform Decision?
No. The July 2026 suspension of Phase 2 changed when C3PAO assessments are required in contracts. It did not change DFARS 7012, which still requires NIST SP 800-171 and FedRAMP Moderate or equivalent cloud services for CUI. A platform decision lasts longer than any pause.
Talk to Intech Pacific About Your CUI Platform
Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam, and the only MSP in the region with CMMC Certified Assessors on staff. We have taken more companies through C3PAO certification than every other company in Hawaii and Guam combined.
To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.
