Question 1

Is CMMC still required in 2026 after the July 2026 suspension?

Accepted Answer

Yes, the framework is intact and the 110 practices are unchanged. DFARS 252.204-7012, NIST SP 800-171 Rev 2 implementation, SPRS scoring, annual affirmation and subcontractor flowdown all remain fully in force, and Level 1 and Level 2 self-assessments continue to be designated in solicitations. What the Department of War CIO suspended on 13 July 2026 is Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program, meaning Level 2 C3PAO certification can no longer be designated as a condition of award, and contracting officers must remove that designation from active solicitations. DFARS 252.204-7021 remains codified. A reform task force review is pending, so the certification requirement may return in a modified form.

Question 2

Can Google Workspace be used for Controlled Unclassified Information (CUI)?

Accepted Answer

Yes, in the right edition. Google states that Google Workspace Enterprise obtained a FedRAMP High Authority to Operate in 2021 and therefore supports customers seeking compliance with DFARS and CMMC, and Google scopes its CMMC implementation guide specifically to Google Workspace Enterprise Plus with the Assured Controls Plus add-on. Under DFARS 252.204-7012(b)(2)(ii)(D), any cloud service holding covered defense information must meet the FedRAMP Moderate baseline or higher, or demonstrated equivalency. Standard commercial editions of any productivity suite do not meet that bar. Confirm your edition and obtain the Google Customer Responsibility Matrix from your Google account team before relying on this.

Question 3

Do I need Microsoft 365 GCC High for CMMC Level 2?

Accepted Answer

Not necessarily. GCC High is one path, and it is a platform replacement rather than an added control: published planning bands run from 10 to 20 weeks to stabilization for a mid-sized organization up to 12 to 18 months for a full phased program, with migration services in the tens to low hundreds of thousands of dollars, feature loss, device re-enrollment, and a three to five times increase in support tickets in the first two weeks after cutover. The alternative is to keep Google Workspace Enterprise Plus with Assured Controls Plus and add client-side encryption under a customer-held key, which is what Qanapi Flow Federal provides. Whether that is right for you depends on your full CUI boundary, not only your productivity suite.

Question 4

How many of the 110 CMMC Level 2 practices does Qanapi Flow Federal cover?

Accepted Answer

Qanapi Flow Federal bears on 58 of the 110 practices: 14 where it is the primary technical mechanism you would cite in an assessment, and 44 where it strengthens a practice implemented elsewhere or produces additional evidence. Ten practices move to being handled by Qanapi Flow Federal outright, and 12 practices change category in total. Of the 44 practices that Google and your organization would otherwise share, Qanapi Flow Federal carries 32 while you set the policy, and contributes nothing to the remaining 12. Fifty-two practices in total are unaffected by Qanapi Flow Federal because they are met through policy, process, training, or Google platform controls.

Question 5

Does buying Qanapi Flow Federal make my organization CMMC compliant?

Accepted Answer

No, and any vendor claiming otherwise should be treated with suspicion. Qanapi Flow Federal supplies implementing technical mechanisms and produces evidence. Your organization configures it, operates it, writes the System Security Plan, and remains accountable for every practice. A CMMC Level 2 certification assessment is conducted by an authorized C3PAO, or by DCMA DIBCAC for government-led assessments, against your own plan and your own evidence.

Question 6

Why does client-side encryption change the CMMC responsibility model?

Accepted Answer

Because it converts several practices from a permissions question into a cryptographic one. CUI is encrypted in the client under a key your organization holds, released by an external key access control list service (KACLS), before the data reaches Google, so Google stores ciphertext. For the at-rest, backup, media protection and key management practices, the answer to whether the data was protected no longer depends on the provider key custody. It also gives you a second access decision, made at key unwrap time, that is structurally independent of Google Workspace permissions, and a key access log that records who actually decrypted CUI rather than who opened a file. Google Workspace client-side encryption requires Enterprise Plus or Frontline Plus and per-service enablement.

Question 7

What does Qanapi Flow Federal cost?

Accepted Answer

Qanapi Flow Federal is $25 per user per month with a 7-day free trial. Qanapi Zero Trust is $15 per user per month. Google Workspace Enterprise Plus and the Assured Controls Plus add-on are licensed separately from Google and are quote only. Qanapi Flow Federal includes hosted S/MIME for Gmail email encryption and signing, Live Redaction for Google Docs and Slides, Email Classification for Gmail labeling, and Qanapi operating as the external key service for Google Workspace client-side encryption.

Question 8

What should I verify myself before a CMMC assessment?

Accepted Answer

Obtain the CMVP certificate number and validated module version for the Qanapi cryptographic module and record it in your System Security Plan evidence. Document endpoint scanning as the compensating control for SI.L1-3.14.2 and SI.L1-3.14.5, because Google-side malware scanning cannot inspect client-side encrypted content. Corroborate every inheritance claim against the Google Customer Responsibility Matrix. Confirm that no CUI path in your environment bypasses encryption, because a single unencrypted path invalidates the at-rest and media protection determinations. Note that Google own CMMC Level 2 certification applies to Google Public Sector internal systems and does not transfer to your environment.