# DoD Embeds CMMC Requirements in Contracts

The DoD acquisition rule embedding Cybersecurity Maturity Model Certification (CMMC) requirements in covered contracts took effect on November 10, 2025, and is now in force. Google’s materials describe how Google Cloud and Google Workspace may support contractors’ CMMC efforts, including Google-published attestation letters and implementation guides, and FedRAMP High authorization for specified services. Those platform assurances do not establish a contractor’s compliance: contractors remain responsible for selecting authorized services and configuring their environments to meet applicable requirements, including CISA baselines and shared-responsibility obligations.

- DoD contractors performing covered contracts must address the CMMC requirements applicable to their work; the rule’s effective date has passed.
- For Google Cloud, the source says contractors must use the Assured Workloads data boundary for FedRAMP High and apply the CMMC Customer Responsibility Matrix when configuring systems.
- Procurement and security teams should evaluate the authorization and configuration of the specific services in scope and document their own implementation responsibilities; provider attestations alone do not demonstrate contractor compliance.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 05, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Cybersecurity and Infrastructure Security Agency (CISA)
- National Institute of Standards and Technology (NIST)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

### Vendors
- Google (Provider of Google Cloud and Google Workspace services)

### Key Quotes
> For Google Cloud, you must use the Assured Workloads data boundary for FedRAMP High and utilize the CMMC Customer Responsibility Matrix (CRM) when configuring systems to support CMMC compliance.
> — Original poster

### Sources
- [Enclave using Google Workspace configured with CISA baselines](https://www.reddit.com/r/CMMC/comments/1xonphn/enclave_using_google_workspace_configured_with) - reddit-cmmc