Google Workspace and CMMC: Level 1, Level 2 and Editions

By Shaheer Malik · Updated Oct 28, 2026

Google Workspace can support CMMC. It holds a FedRAMP High authorization, and Google says that for CMMC you must use its FedRAMP High authorized services plus Assured Controls Plus to keep data in the United States. Assured Controls Plus is sold only as an add-on to Enterprise Plus or Frontline Plus, so for CUI (Level 2) plan on those editions. For FCI only (Level 1), the rule itself sets no FedRAMP or edition requirement.^[1][2][3]

What Google says

Google’s CMMC page: “For Google Workspace, you must use FedRAMP High authorized services for CMMC compliance, as well as Assured Controls Plus to enable data storage exclusively within the United States. If needed, you can turn off a service that has not yet been FedRAMP authorized.”^[2] Google also publishes a Workspace CMMC implementation guide and a third-party (C3PAO) attestation letter on the same page.^[2]

Editions

Assured Controls and Assured Controls Plus are “available as paid add-ons with Frontline Plus or Enterprise Plus.”^[3] Business Starter, Business Standard and Business Plus are not on that list.

Does Google Workspace Business Standard meet CMMC Level 1?

Level 1 covers FCI and requires the 15 FAR 52.204-21 requirements; the FedRAMP requirement in the rule applies to cloud providers holding CUI.^[4] So nothing in the rule rules out Business Standard for Level 1: the question is whether your configuration meets all 15, such as limiting access to authorized users, authenticating them, and scanning for malicious code.^[4] Google’s own guidance points to its FedRAMP High services and Assured Controls Plus for CMMC overall; if you may handle CUI later, starting on Enterprise Plus avoids a migration.^[2][3]

For CUI (Level 2)

• The provider must meet FedRAMP Moderate or equivalent and the incident reporting duties of DFARS 252.204-7012.^[5] Google Workspace is listed as FedRAMP High.^[1]
• Turn off services that aren’t FedRAMP authorized, and configure data regions and access as Google’s implementation guide describes.^[2]
• Your Workspace tenant, endpoints and admins are in your assessment scope; Google’s authorization doesn’t give you a CMMC status.^[4]

Comparing with Microsoft? See does CMMC require GCC High.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

Does Google Workspace Business Standard meet CMMC Level 1?

The rule sets no FedRAMP or edition requirement for FCI-only Level 1; you must configure Workspace to meet all 15 FAR 52.204-21 requirements. Google’s own CMMC guidance points to FedRAMP High services with Assured Controls Plus, which needs Enterprise Plus or Frontline Plus.

Is Google Workspace FedRAMP authorized?

Yes. Google Workspace is listed on the FedRAMP Marketplace with a High authorization.

Which Google Workspace edition do I need for CMMC Level 2?

Google says to use FedRAMP High services plus Assured Controls Plus, which is a paid add-on available only with Enterprise Plus or Frontline Plus.

Sources

1. FedRAMP Marketplace: Google Workspace (High) (checked Oct 28, 2026)
2. Google Cloud: U.S. Cybersecurity Maturity Model Certification (CMMC) (checked Oct 28, 2026)
3. Google Workspace Help: About Assured Controls and Assured Controls Plus (checked Oct 28, 2026)
4. 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
5. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)

More on cloud, tools and enclaves

• Does CMMC Require GCC High? Microsoft 365 Options Compared
• Is Box, Dropbox, HubSpot or ChatGPT CMMC Compliant?
• CMMC Enclave: What It Is, When You Need One, What It Costs
• CMMC Compliance Software: What It Can and Can’t Do