GCC / GCC High / DoD tenant delivery. FedRAMP + CMMC 2.0 methodology. Agency past performance. US-citizen delivery for classified tenants.
Last updated by Errin O'Connor, Founder & Chief AI Architect, EPC Group
Federal SharePoint consultants must demonstrate seven capabilities: named agency past performance, GCC / GCC High / DoD tenant delivery, FedRAMP-aligned methodology, CMMC 2.0 support, US-citizen delivery, records management depth, and Section 508 accessibility. Six tenant environment tiers match data classification (Commercial / GCC / GCC High / DoD IL4-5 / Azure Government / TS-SCI). EPC Group federal past performance: FRBNY TARP Congressional Oversight Committee, NARA records management, invited contributor to first U.S. CIO 25-Point Plan. Fixed-fee engagement model with US-citizen delivery for GCC High + DoD tenants.
Seven federal-readiness requirements: (1) Named past performance on agency contracts — civilian, DoD, or intelligence community — with sanctioned public references. (2) GCC / GCC High / DoD tenant delivery experience with documented boundary configurations. (3) FedRAMP-aligned delivery methodology mapped to NIST 800-53 controls (Authorization Boundary Diagram, Control Implementation Summary, Continuous Monitoring plan, shared-responsibility matrix). (4) CMMC 2.0 Level 1-3 readiness support for DoD-adjacent contractors. (5) US-citizen delivery team commitment for GCC High + DoD tenants. (6) Records management practice depth (NARA-aligned schedules, retention labeling via Purview, hold policies). (7) Section 508 accessibility expertise for public-facing intranets. Ask for evidence of each — press releases, contract vehicle listings, cleared personnel records.
Six tenant environment tiers matched to data classification: (1) Microsoft 365 Commercial — CUI Basic; NOT approved for CUI Specified, ITAR, EAR, or FCL work. (2) Microsoft 365 GCC — CUI Basic + CJIS + FBI CJIS data; FedRAMP Moderate impact level; US persons only for administrative access. (3) Microsoft 365 GCC High — CUI Specified + ITAR + EAR + DFARS 7012 + NIST 800-171 + CMMC Level 3; FedRAMP High baseline; US-citizen access only. (4) Microsoft 365 DoD — DoD IL4 / IL5 data; separate tenant from GCC High. (5) Azure Government — same US-citizen access requirements + FedRAMP High + DoD IL2-IL5 workload support. (6) Azure Secret / Top Secret — IC / DoD workloads on Azure Government Secret (JWICS-adjacent). Tenant choice is the single most important design decision — the wrong choice restarts the entire program.
Six-phase methodology: (1) Federal fit-call — 45 minutes with senior architect + federal practice lead + your CISO / ISSO / contracting officer to confirm classification, tenant target, past performance requirements, personnel clearance requirements, contract vehicle. (2) Phase 1 discovery (fixed-fee, 3-4 weeks) — current-state assessment, target-tenant boundary design, control mapping to NIST 800-53 / 800-171, migration architecture, ATO/A&A documentation gap analysis. (3) Phase 2 architecture design (fixed-fee, 4-6 weeks) — detailed target-state architecture, information architecture, security control implementation summary, migration runbook, cutover plan. (4) Phase 3 implementation — pilot tenant configuration, IA build-out, integration configuration. (5) Phase 4 migration + cutover — wave-based content migration with dual-hop validation. (6) Phase 5 sustainment — ongoing managed services with US-citizen delivery for GCC High/DoD tenants. Deliverables include ABD, CIS, ConMon plan, shared-responsibility matrix, and all evidence artifacts required for the agency ATO package.
EPC Group federal past performance is deliberately conservative in public naming. Sanctioned references (public information): Federal Reserve Bank of New York (2008-2010 TARP Congressional Oversight Committee support), National Archives and Records Administration (SharePoint records management implementation), invited contributor to the first U.S. CIO Vivek Kundra's 25-Point Plan to Reform Federal Information Technology Management (Obama administration). Additional federal + defense contractor past performance is released under NDA after a Phase 1 fit-call because many state, sheriff, court, tribal, and intelligence community engagements have public-information restrictions that prevent disclosure on a public website. Federal contractor M&A practice includes multiple defense-industrial-base primes and subs — 216+ M&A M365 tenant migrations, 1.83M+ users migrated.
Six pricing anchors for federal SharePoint work: (1) Phase 1 Federal Discovery — 3-4 weeks; produces the target-tenant boundary decision + the Phase 2 fixed-fee proposal. (2) GCC / GCC High tenant configuration + baseline security — 6-10 weeks. (3) SharePoint content migration (up to 1TB, up to 10 site collections) — 8-14 weeks. (4) SharePoint content migration (enterprise scale, 5TB-50TB, 100+ site collections, records-management-heavy) — 4-9 months. (5) FedRAMP ATO documentation support (ABD, CIS workbook, ConMon plan) — 4-8 weeks. (6) Sustainment / managed services retainer — monthly, scoped to tenant complexity and user count. Every anchor is a fixed fee quoted after a scoping call — no time-and-materials sprawl on federal engagements.
EPC Group delivers federal engagements via three primary paths: (1) Direct contract to agency where agency has authority to contract directly with small businesses. (2) Prime contractor teaming — EPC Group as Microsoft-specialist subcontractor to primes on multi-year IDIQ / BPA / GWAC vehicles (SEWP, CIO-SP4, GSA MAS, Alliant 2, OASIS+). (3) Federal contract vehicles held by strategic teaming partners. Prior contract vehicle experience includes GSA schedule teaming and multiple prime-sub relationships across civilian and defense agencies. Specific vehicle availability discussed at Phase 1 fit-call because it depends on agency + scope + timeline. For agencies without pre-existing vehicles: direct micro-purchase authority up to $10K, simplified acquisition procedures up to the $250K SAT threshold, or full FAR-15 competitive procurement for larger scopes.
Personnel clearance capabilities depend on tenant classification: (1) Public / CUI Basic (commercial tenant) — US persons preferred, no formal clearance required. (2) GCC (CUI Basic + CJIS) — US persons only for administrative access. (3) GCC High (CUI Specified + ITAR) — US-citizen delivery team commitment; interim security screening may be required by agency. (4) DoD IL5 — US citizens + interim TS clearance eligible for some workloads. (5) TS / SCI — cleared personnel available through partner teaming arrangements for IC-adjacent workloads. Cleared-personnel capacity is discussed at Phase 1 fit-call. Contract structure ensures cleared personnel are named in delivery team from day one — no bait-and-switch where cleared personnel appear only in the proposal.
45-min federal fit-call with senior architect + federal practice lead + your CISO / ISSO. Call (888) 381-9725.
Monday-Friday, 8 AM - 7 PM CT
We respond to all inquiries within one business day
AI assistant — not human