Data Security Policy

1. Introduction

Government Contractors (GovCons) need to know with confidence that the external systems they use will support their cybersecurity and compliance goals. For many GovCons, certification at the appropriate level of CMMC will be necessary to win contracts.

GCA provides this confidence through its platform deployed within Microsoft's Azure Government and Microsoft 365 GCC High cloud environment. This deployment model ensures that all data, systems, and operations meet the rigorous security and compliance requirements mandated by the U.S. Department of Defense and other federal agencies.

2. Cloud Infrastructure Certifications

The GCA platform is deployed within Microsoft's Azure Government and M365 GCC High environment, maintaining the following critical certifications:

Authority and Scope

These certifications ensure that GCA meets the stringent requirements for Federal Contract Information (FCI), Controlled Unclassified Information (CUI), and Contractor-Defined Information (CDI). The independent 3PAO assessments validate compliance with NIST standards and DFARS requirements essential for government contracting.

3. Third-Party Assessment

GCA is 3PAO attested as FedRAMP Moderate (NIST SP 800-53) and NIST SP 800-171 (CMMC Level 2 equivalent) compliant. These independent assessments validate our security posture against the most rigorous federal standards.

Body of Evidence (BOE)

GCA provides clients with comprehensive documentation to support their own security compliance requirements:

• Letters of attestation from independent 3PAO assessor
• 3PAO assessment Control Implementation Summary (CIS) detailing each security control
• Customer Responsibility Matrix (CRM) clarifying vendor vs. customer security obligations
• GCA-Client Shared Responsibility Matrix for Azure Government and GCC High services

This documentation enables GovCons to demonstrate their own CMMC compliance and satisfy government contract requirements with confidence.

4. Data Protection Capabilities

GCA clients can be confident in the following capabilities:

1. Store and share CUI and proprietary artifacts across the entire business development and proposal lifecycle
2. Comply with CMMC v2.0 Level 2 requirements without additional vendor management burden
3. Leverage extensive security controls for collaboration and sensitive proposal data
4. Meet NIST SP 800-171 control requirements as part of standard platform deployment
5. Access audit logs and attestation documentation for government contract submissions

Encryption and Data Handling

All data is encrypted in transit (TLS 1.2+) and at rest within Azure Government. GCA does not require customers to implement additional encryption layers-security is embedded within the platform infrastructure.

Access Controls

Role-based access control (RBAC) is enforced across all GCA services. User authentication is handled through Azure AD integration within GCC High, ensuring only authorized personnel can access sensitive proposal and business development data.

5. Personnel and Data Residency

GCA maintains the following operational commitments:

6. Continuous Investment in Security

GCA is committed to maintaining and improving the extensive security controls required by government contractors. Our investment strategy includes:

• Regular security assessments and penetration testing by independent 3PAOs
• Automated monitoring and threat detection across all infrastructure layers
• Timely application of security patches and updates
• Annual re-assessment and re-authorization of cloud infrastructure
• Customer advisory program for security best practices and new capability announcements

This continuous improvement ensures that GCA remains compliant with evolving federal security requirements and industry best practices.

7. Contact Information

Security and Compliance Inquiries

Email: security@gcagov.com

General Information

Email: info@gcagov.com

Phone: 202-990-6030

Address: 1309 Coffeen Ave, Suite 11198, Sheridan, WY 82801, USA

For additional documentation, audit logs, or to request an assessment, please contact our security team.