2-Step Verification
Enforced for everyone, with security keys or passkeys only for administrators and anyone who handles CUI.
SP 800-171 3.5.3
Google Workspace for federal and defense work
We set up Google Workspace for companies that hold federal and defense data. That covers which edition and add-ons you buy as well as the admin settings an assessor checks.
Workspace holds a FedRAMP High authorization and a DoD IL4 provisional authorization. Our engineers have Google certifications.
What each requirement takes in Workspace
| Requirement | What Google requires |
|---|---|
| FedRAMP High | Enterprise Plus, Frontline Plus, Business Continuity or Business Continuity Plus, using only the services inside the authorization. |
| IL4 | Enterprise Plus or Frontline Plus, with the Assured Controls Plus add-on. |
| CMMC | FedRAMP High authorized services and Assured Controls Plus, by Google’s own CMMC guidance. |
| ITAR | Client-side encryption, with the keys and the identity provider held by you, for the ITAR’s end-to-end encryption carve-out. |
| DFARS incident notice | Google commits to notify within 72 hours only where Assured Controls is configured. |
Sources: Google’s FedRAMP and IL4 scope (opens in a new tab), CMMC (opens in a new tab), ITAR (opens in a new tab) and DFARS (opens in a new tab) pages. Not every Workspace service is inside each authorization.
How client-side encryption keeps Google out
Whether the ITAR carve-out applies depends on who can decrypt the data. With client-side encryption you hold the keys, so Google stores files it cannot read.
Sign in
Your identity provider verifies the user before they can encrypt a file or open an encrypted one.
From Google’s client-side encryption developer guide (opens in a new tab) and admin help (opens in a new tab).
The admin settings we configure
Context-Aware Access
Access to Gmail, Drive and the admin console refused from devices that are unknown or out of compliance.
SP 800-171 3.1.1
Endpoint management
Phones, tablets and computers enrolled, with the screen lock, encryption and remote wipe your policy sets.
SP 800-171 3.1.18
Data loss prevention
Rules that find CUI markings in Drive and Gmail and block or warn on sharing outside the organization.
SP 800-171 3.1.3
Client-side encryption
Your key service and identity provider connected, and encryption required for the organizational units that need it.
SP 800-171 3.13.16