Program status, 18 August 2026. DFARS 252.204-7012, NIST SP 800-171 Rev 2 implementation, SPRS scoring and annual affirmation remain fully in force, and the 110 CMMC Level 2 practices below are unchanged. On 13 July 2026 the Department of War CIO suspended CMMC Phase 2, so Level 2 C3PAO certification cannot currently be designated as a condition of award. DFARS 252.204-7021 remains codified and a reform task force review is pending. Sources

Meet CMMC Level 2 in Google Workspace, on time and in budget.

Google Workspace Enterprise Plus with Assured Controls Plus can hold Controlled Unclassified Information (CUI) under DFARS 252.204-7012, because Google Workspace Enterprise holds a FedRAMP High Authority to Operate. Migration to Microsoft 365 GCC High is not required. Qanapi Flow adds client-side encryption under a key you hold, hosted S/MIME for Gmail, and email classification and live redaction for Docs and Slides, so Defense Industrial Base (DIB) contractors keep the tenant their people already use.

Below is every one of the 110 Cybersecurity Maturity Model Certification (CMMC) practices, who is responsible for each one, and exactly what changes when Qanapi Flow Federal is deployed. No form. No sales call first.

Start the 7-day free trial Download the control mapping workbook See summary placemat

Qanapi Flow Zero Trust (CMMC Compliance) is $15 per user per month. Flow Federal is $25 per user per month and expands to DOD IL, ITAR, and FedRAMP compliance. The workbook is free and ungated to help in your compliance journey.

110practices mapped, one by one
58practices Qanapi Flow Federal bears on
12practices that change hands
0tenant migrations required

01 · Understanding your responsibilities

Who is responsible for each of the 110 CMMC practices in Google Workspace?

With Google Workspace Enterprise Plus and Assured Controls Plus alone, Google handles 42 of the 110 practices for you. That leaves 47 controls that need to be manually set up by hand inside your Google Workspace, and 21 more entirely outside it.[1] That is 68 practices of manual work. Adding Qanapi Flow changes the split and brings your manual list down from 68 practices to 31, and of the 31 that remain, 18 are policy, training and physical controls that no product can perform for you.[16] Toggle between the two configurations and watch the bar move.

What "Handled by Qanapi Flow" means. Qanapi Flow supplies the implementing technical mechanism. Your organization still turns it on, operates it, and produces the evidence, and accountability for the practice remains with you. No product makes an organization compliant on its own. The value is that the mechanism exists, is cryptographic rather than permission based, and produces evidence an assessor can test. Encrypting content under a key you hold is delivered by Google Workspace client-side encryption with Qanapi operating as the external key access control list service (KACLS), which requires Google Workspace Enterprise Plus or Frontline Plus and per-service enablement.[15] Within Qanapi Flow the components are distinct: hosted S/MIME signs and encrypts Gmail, Live Redaction encrypts Google Docs and Slides, and Email Classification applies visible labels to Gmail.

See all 110 practices as a map, grouped by CMMC domain

One square per practice, colored by who is responsible. Watch the map recolor when you switch the toggle above.

A dark notched corner marks a practice that changes hands when Qanapi Flow is deployed. Hover, tap, or tab to any square for the full requirement, who is responsible for it, and the Qanapi Flow mechanism where one applies. Every practice is also in the workbook, which you can download and edit.

Changes hands with Qanapi Flow
Access Control 22
Awareness and Training 3
Audit and Accountability 9
Configuration Management 9
Identification and Authentication 11
Incident Response 3
Maintenance 6
Media Protection 9
Personnel Security 2
Physical Protection 6
Risk Assessment 3
Security Assessment 4
System and Communications Protection 16
System and Information Integrity 7

02 · Comparing vendor costs

What does CMMC readiness cost in Google Workspace versus GCC High?

Qanapi Flow Zero Trust is $15 per user per month. The comparable Virtru tier, the only one carrying CMMC, FedRAMP and Google Workspace client-side encryption, is published at $499 per month for five users, which is $99.80 per user.[10] At 100 users, staying in Google Workspace with Qanapi Flow costs approximately $66,000 in the first 12 months, with no deployment fee. Migrating the same 100 users to Microsoft 365 GCC High costs approximately $250,000 in the first 12 months, plus 6 to 12 months of migration work. Enter your own numbers below to dive into the details. Qanapi pricing is our own list price, and the migration services figure is interpolated between published bands.[14] Assessment cost is shown separately, because you incur it on any path.

Published rates used
Qanapi Flow Zero Trust$15
Virtru Compliance tier[10]$99.80
Microsoft 365 G5 GCC High[7]$93.40
Google Workspace Enterprise Plus[9]$30
Per user per month. Google Workspace applies to the first two paths equally.
Change these assumptions
Qanapi list price, applied up to 100 users. Above that we quote against your environment. Qanapi Zero Trust is $15.
Google does not publish Enterprise Plus list pricing. $30 is a third party estimate.[9]
Quote only from Google, and required for the compliance posture this page describes.[15] Defaults to zero so it does not silently favor this path. Enter your quoted figure.
AOS-G partner price list, ECF Data.[7] G3 GCC High is $61.10. Annual commitment required.
Virtru's Compliance tier is the only one carrying CMMC, DFARS, ITAR, FedRAMP Moderate ATO, private key hosting and Google Workspace client-side encryption. It is published at $499 per month including 5 users, which is $99.80 per user at that package size.[10] Virtru publishes no rate above 5 users and quotes Enterprise custom, so treat a larger figure as indicative. The cheaper Starter and Business tiers do not carry CMMC or FedRAMP.[11]
Two staff at $100,000 each on 50 percent allocation, as modeled by Virtru,[12] which competes with the GCC High path and has an interest in figures adverse to it.
Change this to reprice every path below.
Head to head at Virtru's own published package size, five users, with no extrapolation on either side.
$125Qanapi Flow Federal
5 users, per month
$499Virtru Compliance tier
5 users, per month[10]
Costs you incur on any path, shown separately because they are not a differentiator.
A CMMC Level 2 certification assessment is estimated by DoD at $104,670 over three years for a small entity and $117,768 for an other than small entity.[3] DoD explicitly excluded the cost of implementing the 110 practices themselves from that figure, on the assumption they were already implemented under DFARS 252.204-7012. Independently, 49 percent of NDIA survey respondents reported spending more than $100,000 on the nonrecurring cost of implementing NIST SP 800-171.[5] With Phase 2 suspended as of 13 July 2026, certification assessments are not currently a condition of award.[2]

03 · Comparing vendor timelines

How long does a Microsoft 365 GCC High migration take?

Between three and eighteen months, depending on size and scope. Qanapi Flow deploys into the Google Workspace tenant you already operate, no migration necessary.

See the migration time you avoid, and what it involves

Published planning bands, the internal labor absorbed, and what breaks during a cutover.

Published planning bands run from 10 to 20 weeks to stabilization for a mid-sized organization[13] up to 12 to 18 months for a full phased program,[8] with 3 to 6 months cited for small contractors rising to 12 to 18 months for mid-size.[12] These are not directly reconcilable, because they measure different scopes.

What a GCC High migration involves, from published accounts. Outlook profiles break and mobile devices require re-enrollment. Support ticket volume increases three to five times in the first two weeks after cutover. External sharing becomes restricted to other GCC High tenants. Teams Phone System and PSTN calling are unavailable. SharePoint migration causes formatting loss and broken links, and Teams conversation history exports as static HTML only. Application incompatibility discovery has delayed documented migrations by four to eight weeks. Volume licensing eliminates trial periods, so the financial commitment is immediate.[8][13]

The band shown scales with your user count and is interpolated between the published sources above, which do not agree on scope. Migration services cost is interpolated the same way, between bands of approximately $15,000 to $25,000 at 25 users, $40,000 to $80,000 at 50 to 100 users, and $90,000 to $120,000 and above at 250 users.[14] Qanapi deployment timing should be confirmed with Qanapi for your environment.

04 · Download the Compliance Workbook

Download the free CMMC Level 2 control responsibility mapping workbook

CMMC Control Responsibility Mapping workbook, version 1.0

August 2026. Twelve tabs, all 110 practices, live formulas. Change a determination on the Control Mapping tab and every rollup recalculates. Built for your System Security Plan work whether or not you ever talk to us.

  • All 110 practices with NIST SP 800-171 Rev 2 references and who is responsible for each
  • Columns for your implementation status, evidence artifact reference, and owner
  • A rollup by CMMC domain, and an analysis naming the mechanism behind each contribution
  • Assessment evidence prepared for the 15 practices where Qanapi Flow Federal is the primary or leading mechanism
  • A sources, scope and assumptions tab, including the points requiring your own verification

Microsoft Excel, .xlsx. No email address required.

05 · How Qanapi satisfies the controls

The seven Qanapi Flow mechanisms that satisfy CMMC practices

Qanapi Flow drastically increases efficiency, timeline, and audit-readiness of your Google Workspace environment. Its contribution across the 58 practices it bears on resolves into seven named mechanisms an assessor can point at. The largest group of practices is the one you configure yourself, and it is where most of your work sits: Qanapi Flow strengthens 32 of those 44 practices.[16]

  • Client-side encryption15 of 58

    CUI is encrypted in the client before it reaches Google, under a key the organization holds. Google stores ciphertext.

    It converts several practices from a permissions question into a cryptographic one. Where a control asks whether data was protected, the answer no longer depends on the correctness of a sharing setting.

    Bears on 15 of the 58 practices Qanapi Flow touches. 4 of those are practices Qanapi Flow carries for you while you set the policy.

  • Independent key authorization10 of 58

    Every decryption of CUI requires the Qanapi key access control list service to release a key, and it will only do so against a valid assertion from the organization's own identity provider.

    It gives the organization a second access decision that is structurally independent of Google Workspace permissions. An assessor testing an access control practice can be shown two enforcement points rather than one, and the second is one the cloud provider does not operate.

    Bears on 10 of the 58 practices Qanapi Flow touches. 8 of those are practices Qanapi Flow carries for you while you set the policy.

  • Key access logging13 of 58

    The key access control list service records every wrap and unwrap request with the requesting identity, the resource and the outcome, in a log store separate from Google Workspace audit logs.

    Workspace logs show who opened a file. Key access logs show who actually decrypted CUI. For the audit and monitoring practices this is the more direct evidence, and because it sits in a separate trust domain it cannot be silently altered from the Workspace administrative plane.

    Bears on 13 of the 58 practices Qanapi Flow touches. 11 of those are practices Qanapi Flow carries for you while you set the policy.

  • Key lifecycle and revocation5 of 58

    Keys are generated, rotated, revoked and destroyed under the organization's control, and revocation takes effect immediately.

    Revocation is an enforcement action available in seconds. For incident response it is a containment step that does not wait for data deletion to propagate; for personnel actions it closes the window between a termination and full deprovisioning.

    Bears on 5 of the 58 practices Qanapi Flow touches. 2 of those are practices Qanapi Flow carries for you while you set the policy.

  • Hosted S/MIME2 of 58

    Certificate lifecycle managed automatically across the domain, delivering signed and encrypted mail inside native Gmail, with a CSE-wrapped mode that keeps private keys outside Google's reach.

    It provides message-level confidentiality and sender authenticity that persist beyond the transport session and are verifiable by any standard S/MIME client.

    Bears on 2 of the 58 practices Qanapi Flow touches. None of those are policy-setting practices, because the ones this mechanism carries are handled by Qanapi Flow outright.

  • Classification and redaction3 of 58

    Automatic CUI classification markings on email, and multi-level redaction in Google Docs and Slides.

    Marking and flow-control practices require a label that policy can act on. Applying it automatically removes reliance on the user remembering, which is the failure mode an assessor probes.

    Bears on 3 of the 58 practices Qanapi Flow touches. 1 of those are practices Qanapi Flow carries for you while you set the policy.

  • Administration and enablement10 of 58

    The Qanapi configuration, console roles, change records and user training form a documented part of the organization's configuration baseline and administration model.

    Configuration management and training practices are assessed on documentation, not technology. The Qanapi deployment supplies concrete artifacts: a baseline entry, a change record, a separated administrative role, and role-based training content.

    Bears on 10 of the 58 practices Qanapi Flow touches. 6 of those are practices Qanapi Flow carries for you while you set the policy.

Select any mechanism to see what it does and why it satisfies the practices it does. The order below is editorial, not a ranking, and the practice count is not a measure of value: hosted S/MIME satisfies the fewest practices and is one of the most valuable parts of the bundle. Every practice and its mechanism is named in the downloadable workbook.

Start the 7-day free trial

06 · The cost of doing nothing

What happens if your SPRS score or annual affirmation is inaccurate?

CMMC Phase 2 is suspended. Self-assessment, SPRS scoring and annual affirmation are not. Under DFARS 252.204-7019 an offeror must have an assessment less than three years old posted in the Supplier Performance Risk System (SPRS) to be considered for award, and DFARS 252.204-7020 requires the same of subcontractors before you award to them.[6] There is no minimum score in the DFARS: the requirement is a current assessment. Assessments may still be conducted by the government through DCMA DIBCAC at DoD discretion. The Department of Justice has been pursuing inaccurate attestations directly, and recovered more than $52 million across nine cybersecurity fraud settlements in fiscal year 2025.[4]

Selected Civil Cyber-Fraud Initiative settlements, 2022 to 2026

A selection across four fiscal years, not the nine fiscal year 2025 settlements referred to above. The fiscal year column is shown so the two are not confused. The United States federal fiscal year runs from 1 October to 30 September.

ContractorSettlement AnnouncedFiscal year Allegation
Health Net Federal Services and Centene$11,253,400Feb 2025FY2025Falsely certified cybersecurity compliance in annual reports to the Defense Health Agency. Failed vulnerability scanning, patch, access and firewall controls.
Aerojet Rocketdyne$9,000,000Jul 2022FY2022Misrepresented compliance with contractual cybersecurity requirements.
Raytheon, RTX and Nightwing Group$8,400,000May 2025FY2025No system security plan on a development system spanning 29 DoD contracts. DFARS 252.204-7012 and FAR 52.204-21.
MORSECORP$4,600,000Mar 2025FY2025Submitted an SPRS score of 104 in January 2021 when the actual score was negative 142, uncorrected until June 2023. Third party email host not FedRAMP Moderate compliant. No system security plan.
Aero Turbine and Gallant Capital Partners$1,750,000Jul 2025FY2025NIST SP 800-171 controls not implemented January 2018 to February 2020. Covered defense information transferred to a foreign software firm.
Pennsylvania State University$1,250,000Oct 2024FY2025Failed to implement required controls and to develop adequate corrective action plans.
Georgia Tech Research Corporation$875,000Sep 2025FY2025A December 2020 score of 98 submitted based on a fictitious environment. No anti-malware until December 2021. No system security plan before February 2020.
LOGZONE$507,144Jun 2026FY2026Two Navy contracts, May 2021 to March 2025. DCMA assessed score of negative 170 on the negative 203 to 110 scale.
Swiss Automation$421,234Dec 2025FY2026Supplier failed to safeguard DoD part drawings under NIST SP 800-171.

All figures from Department of Justice Office of Public Affairs press releases, linked from each contractor name.[4]

07 · Frequently Asked Questions

Frequently asked questions about CMMC Level 2 and Google Workspace

Is CMMC still required in 2026 after the July 2026 suspension?

Yes, the framework is intact and the 110 practices are unchanged. DFARS 252.204-7012, NIST SP 800-171 Rev 2 implementation, SPRS scoring, annual affirmation and subcontractor flowdown all remain fully in force, and Level 1 and Level 2 self-assessments continue to be designated in solicitations. What the Department of War CIO suspended on 13 July 2026 is Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program, meaning Level 2 C3PAO certification can no longer be designated as a condition of award, and contracting officers must remove that designation from active solicitations. DFARS 252.204-7021 remains codified. A reform task force review is pending, so the certification requirement may return in a modified form.

Can Google Workspace be used for Controlled Unclassified Information (CUI)?

Yes, in the right edition. Google states that Google Workspace Enterprise obtained a FedRAMP High Authority to Operate in 2021 and therefore supports customers seeking compliance with DFARS and CMMC, and Google scopes its CMMC implementation guide specifically to Google Workspace Enterprise Plus with the Assured Controls Plus add-on. Under DFARS 252.204-7012(b)(2)(ii)(D), any cloud service holding covered defense information must meet the FedRAMP Moderate baseline or higher, or demonstrated equivalency. Standard commercial editions of any productivity suite do not meet that bar. Confirm your edition and obtain the Google Customer Responsibility Matrix from your Google account team before relying on this.

Do I need Microsoft 365 GCC High for CMMC Level 2?

Not necessarily. GCC High is one path, and it is a platform replacement rather than an added control: published planning bands run from 10 to 20 weeks to stabilization for a mid-sized organization up to 12 to 18 months for a full phased program, with migration services in the tens to low hundreds of thousands of dollars, feature loss, device re-enrollment, and a three to five times increase in support tickets in the first two weeks after cutover. The alternative is to keep Google Workspace Enterprise Plus with Assured Controls Plus and add client-side encryption under a customer-held key, which is what Qanapi Flow provides. Whether that is right for you depends on your full CUI boundary, not only your productivity suite.

How many of the 110 CMMC Level 2 practices does Qanapi Flow cover?

Qanapi Flow bears on 58 of the 110 practices: 14 where it is the primary technical mechanism you would cite in an assessment, and 44 where it strengthens a practice implemented elsewhere or produces additional evidence. Ten practices move to being handled by Qanapi Flow outright, and 12 practices change category in total. Of the 44 practices that Google and your organization would otherwise share, Qanapi Flow carries 32 while you set the policy, and contributes nothing to the remaining 12. Fifty-two practices in total are unaffected by Qanapi Flow because they are met through policy, process, training, or Google platform controls.

Does buying Qanapi Flow make my organization CMMC compliant?

No, and any vendor claiming otherwise should be treated with suspicion. Qanapi Flow supplies implementing technical mechanisms and produces evidence. Your organization configures it, operates it, writes the System Security Plan, and remains accountable for every practice. A CMMC Level 2 certification assessment is conducted by an authorized C3PAO, or by DCMA DIBCAC for government-led assessments, against your own plan and your own evidence.

Why does client-side encryption change the CMMC responsibility model?

Because it converts several practices from a permissions question into a cryptographic one. CUI is encrypted in the client under a key your organization holds, released by an external key access control list service (KACLS), before the data reaches Google, so Google stores ciphertext. For the at-rest, backup, media protection and key management practices, the answer to whether the data was protected no longer depends on the provider key custody. It also gives you a second access decision, made at key unwrap time, that is structurally independent of Google Workspace permissions, and a key access log that records who actually decrypted CUI rather than who opened a file. Google Workspace client-side encryption requires Enterprise Plus or Frontline Plus and per-service enablement.

What does Qanapi Flow cost?

Qanapi Flow Federal is $25 per user per month with a 7-day free trial. Qanapi Zero Trust is $15 per user per month. Google Workspace Enterprise Plus and the Assured Controls Plus add-on are licensed separately from Google and are quote only. Qanapi Flow Zero Trust includes hosted S/MIME for Gmail email encryption and signing, Live Redaction for Google Docs and Slides, Email Classification for Gmail labeling, and Qanapi operating as the external key service for Google Workspace client-side encryption.

What should I verify myself before a CMMC assessment?

Obtain the CMVP certificate number and validated module version for the Qanapi cryptographic module and record it in your System Security Plan evidence. Document endpoint scanning as the compensating control for SI.L1-3.14.2 and SI.L1-3.14.5, because Google-side malware scanning cannot inspect client-side encrypted content. Corroborate every inheritance claim against the Google Customer Responsibility Matrix. Confirm that no CUI path in your environment bypasses encryption, because a single unencrypted path invalidates the at-rest and media protection determinations. Note that Google own CMMC Level 2 certification applies to Google Public Sector internal systems and does not transfer to your environment.

Sources and citations

Every figure on this page, and where it came from

  1. [1] Google, Google Workspace CMMC Level 2 Implementation Guide, February 2025. Source of the 42, 47 and 21 baseline. Scope is Enterprise Plus with Assured Controls Plus. Vendor primary.
  2. [2] Department of War CIO, Immediate Suspension and Strategic Review of CMMC Requirements, 13 July 2026, and the implementing memorandum. Government primary.
  3. [3] DoD, CMMC Program final rule, 89 FR 83092, 15 October 2024. Assessment cost figures at 89 FR 83185 to 83186. Government primary.
  4. [4] Department of Justice, False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025, 16 January 2026, source of the fiscal year 2025 aggregate, plus the individual settlement releases linked from each contractor name in the table. Government primary.
  5. [5] NDIA, Vital Signs 2026, April 2026, pages 31 to 32, reporting the NDIA DIB IT and Cybersecurity Survey. Sample size is not published. Independent industry association survey.
  6. [6] DFARS 252.204-7019 and DFARS 252.204-7020. Award eligibility is conditioned by 7019; subcontractor flowdown by 7020. Government primary.
  7. [7] ECF Data, GCC High licensing price list. Microsoft does not publish GCC High pricing. AOS-G licensing partner price list.
  8. [8] CMMC Dashboard, GCC High Migration Roadmap, updated 3 April 2026. Third party estimate.
  9. [9] Atonement Licensing, Google Workspace Enterprise pricing 2026. Google lists Enterprise as quote only. Third party licensing advisory estimate.
  10. [10] Virtru pricing packages, retrieved 18 August 2026. Four tiers, all billed annually and all including 5 users: Starter $119 per month, Business $219, Compliance $499, Enterprise custom. Only the Compliance tier lists CMMC, DFARS and ITAR support, a FedRAMP Moderate ATO, CMMC documentation matrix, private encryption key hosting, FIPS 140-2 encryption and Google Workspace client-side encryption as standard. Virtru publishes no per-additional-user rate. The $99.80 per user figure is our arithmetic on the published 5 user package. Competitor vendor primary.
  11. [11] Vendr, Virtru pricing data, currency February 2026. Observed $8 to $12 per user per month for Google Workspace, for the standard product rather than the Compliance tier. Third party transaction data.
  12. [12] Virtru, The Hidden Cost of a GCC High Migration, 23 June 2026. Source of the internal labor model and one timeline band. Competitor vendor content. Virtru sells an alternative to the GCC High path, so it has an interest in figures adverse to that path. Used here only where the figure is adverse to GCC High, which is also our position, and readers should weigh it accordingly.
  13. [13] Secureframe, GCC High Migration Guide, 6 March 2026, and GCC High Pricing, 8 July 2026. Reseller authored.
  14. [14] i3solutions, How much does GCC High cost, updated 12 August 2026. Source of the migration services bands used in the calculator: approximately $15,000 to $25,000 at 25 users, $40,000 to $80,000 at 50 to 100 users, and $90,000 to $120,000 and above at 250 users. Third party estimate.
  15. [15] Google, About client-side encryption and About Assured Controls and Assured Controls Plus. Client-side encryption requires Enterprise Plus or Frontline Plus and an external key service. Assured Controls Plus is a paid add-on available only to those editions. Vendor primary.
  16. [16] Qanapi Public Sector, CMMC Level 2 Control Responsibility Mapping workbook, version 1.1, August 2026. Source of all 110 practice determinations, which the page restates in plain language, the 58, 14 and 44 role split, the 12 category changes, the 32 of 44 Shared figure, the seven mechanisms and the per-practice evidence lists on this page. Download it. Qanapi primary. This is our own analysis of Google and NIST source material, not an independent assessment.
What you should verify yourself before an assessment. Obtain the CMVP certificate number and validated module version for the Qanapi cryptographic module and record it in your System Security Plan evidence. Google-side malware scanning cannot inspect client-side encrypted content, so endpoint scanning must be documented as the compensating control for SI.L1-3.14.2 and SI.L1-3.14.5. Corroborate every inheritance claim against the Google Customer Responsibility Matrix, obtained from your Google account team. Confirm that no CUI path in your environment bypasses encryption, because a single unencrypted path invalidates the at-rest and media protection determinations. Google own CMMC Level 2 certification applies to Google Public Sector internal systems and does not transfer to your environment. This page is implementation guidance. It is not legal advice and it is not an assessment. A CMMC Level 2 certification assessment is conducted by an authorized C3PAO, or by DCMA DIBCAC for government-led assessments, against your own System Security Plan and evidence.