CMMC Space Users Can Now Send and Receive Encrypted Email with Government Contacts

CMMC Space users can now send and receive encrypted, signed email with government contacts directly from Gmail. It's available today as a CMMC Space add-on for $199 per user per year, including setup, configuration, and ongoing support.

We’re launching this new feature to solve a problem our customers keep running up against. Previously, when a CMMC Space user (or any defense business using Google Workspace) needed to send or receive an encrypted (S/MIME) message, they couldn’t do so in Gmail. The only fix was keeping a separate Outlook setup, which is one more thing to pay for, manage, and keep compliant.

It’s true that CMMC compliance does not require end-to-end encrypted email. It requires that CUI be properly encrypted in transit and at rest, which Gmail does out of the box. More than 120 organizations have passed their Level 2 assessment after standing up CMMC Space without using S/MIME.

Nevertheless, when a government counterpart sends you an S/MIME encrypted message, or expects one back, a Gmail user has historically had two options: fail, or stand up a parallel Outlook environment just for that correspondence. Neither is a real answer for the small defense businesses ATX Defense supports.

More than 120 small businesses are CMMC Level 2 certified on ATX's secure enclave, CMMC Space.

We built CMMC Space to make compliance easy and affordable for small defense contractors. This was a problem we weren’t going to let go.

So we asked Qanapi, a long-time partner, to help us develop a solution. All the details are below, but if you’re a defense contractor, here’s what this means for you:

 

  • If you use Google Workspace, but run a small Outlook enclave or a personal Outlook profile just to talk to the government, you don’t have to do that anymore.
  • If you're on Microsoft 365 GCC High primarily because of encrypted email, and you'd rather be on Google for everything else, this changes the math.
  • If you're currently using CMMC Space, this slots directly into an environment that has already passed assessment.

How it works

TL;DR: We use Qanapi Flow’s Zero Trust bundle to give CMMC Space users a certificate that lets Gmail open and send encrypted email with .mil addresses. Our team sets it up for you, and there's nothing to install. After that, you write and send email like you always do. The signature and encryption are applied for you. The add-on includes:

 

  • Encrypted email in Gmail with your government contacts
  • Client-Side Encryption (CSE) for Google Workspace, so protected content is encrypted before it reaches Google's servers
  • Live redaction in Google Docs and Slides, so a document with a mixed audience doesn't need a separate sanitized copy
  • Automatic email classification that applies CUI and other required markings for you

The details

Qanapi Flow issues and hosts an S/MIME certificate for each user that meets Google's profile and manages the private keys in Qanapi's key service, which runs in The Armory, a FedRAMP High authorized environment (package ID FR2513256853). There is also a non-FedRAMP version, which is fine for CMMC because no CUI ever touches Qanapi’s servers.

The DoW PKI roots and intermediates also have to be loaded into your tenant so that signatures from .mil senders validate. Hosted S/MIME means the certificate and its private key are loaded into Gmail through Google's S/MIME API. Qanapi generates, escrows, rotates, and revokes those keys so that nobody on your side is handling a PKCS #12 file, and so that a departing employee does not take a mailbox full of unreadable history with them.

If what you want instead is key custody that Google itself cannot reach, that is CSE, which the Zero Trust bundle also solves for. Your existing ECA credential stays exactly where it is for DoW website logins.

The user experience is what it should be: open Gmail, write the email, send.

And as with everything else we have done to bend the CMMC cost curve, we’re not charging $250k for the solution. We’re offering it at $199 per user per year, which includes our setup, DoW trust chain configuration, and ongoing support.

If you want to see it work before you believe it, that’s fair. Contact us and we'll show you a live exchange.