I’m a SMB and I’m trying to avoid purchasing GGC High due to complexity and cost. I only have a handle full of users who need access to CUI from a contractor basis. If I, by policy and controls, restrict users from sending and receiving CUI from GCC, would I still be in compliance to have users view CUI on company laptops if laptops have all CUI controls (eg. GCC E5 endpoint protection for instance), and information never leaves endpoint (never goes one drive, teams, etc)? Does the fact that I am using non compliant L2 services invalidate this approach?

Also does anyone have any non-biased recommendations on resellers to purchase GCC licenses? What’s the average cost per user for GCC E5? Please note I don’t want your sales pitch if you are a reseller in this sub. I’d like to hear from customers who have purchased through a reseller that has had a good experience and support.