Azure Government Landing Zone
Design and build an Azure Government landing zone for work that handles controlled unclassified information (CUI), with Azure Policy mapped to the NIST SP 800-171 controls in scope.
From $25,000
Quoted against an Assessment or Blueprint. Microsoft's landing zone code is not supported in US Government clouds, so it is adapted and tested by hand.
When it fits
Your contract requires CUI to stay in Azure Government, and Microsoft's landing zone deployment tooling is not supported in US Government clouds, so the reference design has to be adapted by hand.
What changes
A working landing zone in your Azure Government subscriptions, with policy mapped to the controls in scope, the remaining gaps listed, and every design decision recorded for your security team and assessor.
What you receive
- Landing zone design adapted from Microsoft's reference architecture for Azure Government
- Management groups, policy, identity, networking, logging, and Key Vault deployed as code in your subscriptions
- Azure Policy assignments mapped to the NIST SP 800-171 controls in scope, with the gaps that policy cannot cover listed
- Decision records and handover documentation your security team and assessor can review
What we agree first
- An Azure Government tenant and subscriptions that you own
- The contract's CUI and DFARS requirements, and your System Security Plan if one exists
- Who owns identity, security, and operations after handover
Scope, fee, acceptance criteria, and timing are agreed before work starts.
Before you engage
The access we need and where the work stops, for your security and procurement reviewers.
What access we need
- Time-limited accounts in your Azure Government tenant with rights on the target subscriptions, removed at handover
- Changes made as code through your change-approval process
- No CUI is needed to build the landing zone: test data only
- Access reviewed at each phase and closed when the engagement ends
Scope boundaries
CMMC certification, the third-party assessment, and your System Security Plan stay with your organization. Microsoft 365 GCC High configuration and ongoing operations are quoted separately.
View example deliverablesCloud Adoption Framework or Well-Architected: Which One Answers Your Question
The two Azure frameworks answer different questions; use the Cloud Adoption Framework for estate decisions and the Well-Architected Framework for a single workload, and name the control owner where they overlap.
More from Azure Adoption and Governance
What does your team need to settle?
Bring the solicitation or the system, your deadline, and the constraints. Scope, deliverables, and fee are agreed before work starts.
Discuss this engagement