Background: We are a small federal consulting company about 100 employees. We have been working with our MSP on going through our processes and controls as we prepare for CMMC Level 2 and pretty comfortable with where we are at, however, we are now taking a look at GCC High to see if it's worth going the extra mile to not only be CMMC audit ready but also if the cost of having GCCH could be worth the appeal to future potential DoD clients and projects.

What we currently have: About a quarter of employees have Microsoft 365 Business Premium licenses and 75% use Business Basic. We use PreVeil Business plan (about 10 seats) to handle our CUI documents.

Questions: Does anyone have insight on costs for GCC high for a company this size?

Would only employees that work with CUI need GCC high while the other employees remain with Business Basic plan? Or does GCCH have to be applied to the enterprise?