This is more of a generic question for the time being but I am curious. I know for M365 apps they have GCC, GCC High and DoD depending on your use case.

Say you were working with CUI or ITAR data but only had a normal GCC license (or commercial). Would it be sufficient enough to stay in compliance if you enforced that data from ever touching any of those apps (IE it was only stored on an on prem server and never went through any of M365 apps) or does just having that type of data within your company automatically mean you have to move to GCC high etc.

Digging into the rabbit hole deeper, say you had the data on prem and it stayed there but what if something that was CUI or ITAR was a word document and you opened it up in word. It is saved locally but word is part of the 365 suite so would that mean it needs to be GCC High?