I recently consulted a lawyer specializing in corporate ITAR imports and exports to delve into the GCC madness I often encounter in CMMC forums. I posed this query for his expert legal perspective:

"In the context of compliance with the EAR and ITAR, I seek clarification on the legal implications of using Microsoft's Office 365 commercial cloud services for transmitting and storing ITAR-sensitive data. Specifically, does the potential transmission and storage of this data on servers located outside the United States constitute a violation of these regulations?"

While he preferred not to have his entire response shared on Reddit, he did permit me to share this key excerpt:

"Provided that the data is encrypted in accordance with FIPS 140-2 standards, and ensuring that it is neither transmitted from nor deliberately sent to non-U.S. persons outside the United States, the transmission or storage of unclassified ITAR data via international communication networks does not qualify as an export, reexport, retransfer, or temporary import under the current regulatory framework. Consequently, such actions would not be in contravention of the EAR or ITAR."

Given these considerations, I am confident and at ease with the decision to store ITAR data within my commercial Office 365 environment and do not anticipate any compliance concerns.

I strongly encourage you to conduct your own thorough research beyond the confines of the CMMC/DFARS 7012 communities, as this will provide a broader and more comprehensive understanding of the complexities and nuances involved in data security and regulatory compliance.

Moreover, engaging a specialized attorney for personalized legal guidance on this matter could prove to be significantly more cost-effective than transitioning from an E5 to a G5 subscription.