CMMC and ITAR compliant email for small shops
Published 2026-10-22
An email with a marked drawing attached is CUI twice over: moving, and sitting in two mailboxes. NIST SP 800-171 asks for encryption while it travels SC.L2-3.13.8, protection while it is stored SC.L2-3.13.16, and FIPS-validated cryptography for both SC.L2-3.13.11. DFARS 252.204-7012 adds one more test for the provider that holds the mail: security equivalent to the FedRAMP Moderate baseline.
No email service is "CMMC certified"; CMMC assesses your company, not a product. What a service can do is meet the parts of the rule that land on it. We read five services' own pages and the FedRAMP Marketplace against those parts, plus the ITAR question every shop with export-controlled drawings has to answer. Not sure an email is CUI at all? Run it through the is-it-CUI check first.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Virtru
It encrypts end to end inside the Gmail or Outlook you already use, and its FedRAMP Moderate certification is in the Marketplace, not just on its own site.
Read the Virtru notesPreVeil
Outside suppliers open a free account to read and reply, keys never leave users' devices, and 7012 incident support is stated on the page.
Read the PreVeil notesMicrosoft 365 GCC High
When CUI runs through most mailboxes, one government tenant with screened staff beats a second system bolted beside the first.
Read the Microsoft 365 GCC High notes
Five services against the rule
Rows inside the boundary are what DFARS 252.204-7012, NIST SP 800-171, ITAR and the CUI marking rule ask of the service that carries your CUI mail. Rows outside it are how the service fits your day. Every word was read on the vendor's own page, or in the FedRAMP Marketplace, on 2026-10-22.
| What the rule asks | Virtru | PreVeil | Microsoft 365 GCC High | Kiteworks | Google Workspace |
|---|---|---|---|---|---|
| Inside the boundary | |||||
| FedRAMP Moderate or equivalent for the cloud that holds the mailDFARS 252.204-7012(b)(2)(ii)(D) | Certified (Moderate) | Vendor states equivalency | Certified (High) | Certified (Moderate) | Certified (High) |
| FIPS-validated encryption in transit and at rest, end to end where the vendor says soNIST SP 800-171 3.13.8, 3.13.11, 3.13.16 | FIPS 140-3, end to end | FIPS 140-3, end to end | FIPS 140-2 stated | FIPS 140-3 stated | Not stated for Workspace |
| An ITAR route: US-persons-only access, or the end-to-end encryption carve-out22 CFR 120.54(a)(5); 22 CFR 120–130 | Carve-out stated | Carve-out stated | ITAR terms | US citizens stated | Carve-out stated |
| Supports 7012 incident reporting: 72 hours, 90-day imagesDFARS 252.204-7012(c)–(g) | 7012 named, 72 h not | 7012 (c)–(g) stated | In DFARS scope list | Not stated | 72-hour notice only |
| Puts a CUI banner on the message32 CFR 2002.20(b) | Watermarks files | Not stated | Labels stated | Reads Office labels | Not stated |
| Outside the boundary | |||||
| Works inside Outlook or Gmail | Gmail and Outlook plug-ins | Outlook, Gmail, Apple Mail | Outlook, native | Outlook plug-in | Gmail, native |
| How an outside recipient reads it | No new password stated | Free account | Not stated | Link to a held file | Not stated |
| Phone app | Not stated | iOS and Android | Not stated | Mobile app stated | Not stated |
| Retention or archiving | Not stated | Retention tools stated | Not stated | Not stated | Vault, FedRAMP High |
What the words mean
- MeetsCertified (Moderate)FIPS 140-3, end to endCarve-out statedGmail and Outlook plug-insNo new password stated7012 (c)–(g) statedOutlook, Gmail, Apple MailFree accountiOS and AndroidRetention tools statedCertified (High)FIPS 140-2 statedITAR termsLabels statedOutlook, nativeFIPS 140-3 statedUS citizens statedOutlook plug-inLink to a held fileMobile app statedGmail, nativeVault, FedRAMP High
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- Partial7012 named, 72 h notWatermarks filesVendor states equivalencyIn DFARS scope listReads Office labels72-hour notice only
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot statedNot stated for Workspace
- Not stated in what we read. Ask the vendor in writing before you rely on it.
Where a CUI email actually sits
Follow one message: a purchase-order spec marked CUI, going from your engineer to a supplier. It touches five places, and the rule reaches three of them. The provider that holds your mail counts even if it only passes the message along, because 7012 names any cloud that will "store, process, or transmit" covered defense information.
- 01
Your laptop or phone
In your SSP like any other endpoint that touches CUI.
Controlled by: You
- 02
Your mail provider
Stores and transmits CUI, so 7012(b)(2)(ii)(D) applies: FedRAMP Moderate or equivalent.
Controlled by: The provider, under your contract
- 03
The trip between mail servers
3.13.8: encrypted in transit unless physically protected, with FIPS-validated crypto (3.13.11).
Controlled by: Nobody in particular
- 04
The recipient's mail provider
Their boundary, not yours. If they are your sub, 7012(m) flows the clause down to them.
Controlled by: The recipient
- 05
The recipient's screen
Their boundary. Your job was to send it only to someone authorized.
Controlled by: The recipient
Your obligation under the ruleThe recipient's obligation
The five services in the table change which of those places can read the message. That, more than any feature list, is the choice you are making.
| Kind of service | Who can read the message on the way |
|---|---|
| End-to-end add-onVirtru, PreVeil | Only the sender and the recipient. Every server in between holds ciphertext. |
| Held-file linkKiteworks | The platform's server. The recipient gets a link, the file never travels. |
| Government tenantGCC High, Workspace with Assured Controls | Every hop inside the tenant. A message to an outside address leaves it unless you add encryption. |
Two ways to email ITAR drawings
ITAR technical data adds a second law to the same email. Under 22 CFR 120.50, releasing technical data to a foreign person, even inside the United States, is an export: a deemed export that needs State Department authorization. A mail provider whose foreign staff can read your mailbox is that problem in waiting. There are two ways to deal with it, and each service in the table takes one or the other.
Keep the readers to US persons
The provider limits who can reach your data to screened US persons and keeps it in the US. Microsoft verifies US citizenship for staff with access to GCC High customer content; Kiteworks states US-only support staff for its FedRAMP offering. You still control your own users.
Make the provider blind
Encrypt end to end so the provider never holds a readable copy. Under 22 CFR 120.54 the sending and storing is then not an export at all. PreVeil and Virtru state this route, and Google states it for Workspace client-side encryption.
"The ability to access technical data in encrypted form that satisfies the criteria set forth in paragraph (a)(5) of this section does not constitute the release or export of such technical data."
The carve-out only holds if all five conditions in paragraph (a)(5) do. Paragraph (b) then defines end to end strictly: the data is never unencrypted between the two security boundaries, and the means of decryption are not provided to any third party, the email provider included.
| The rule says the data is | What that means for an email |
|---|---|
| Unclassified§ 120.54(a)(5)(i) | Controlled drawings and specs, never classified material. |
| Secured using end-to-end encryption§ 120.54(a)(5)(ii) | Encrypted from your boundary to the recipient's, and the provider is never given the means to decrypt. |
| FIPS 140-2 or its successors, or at least AES-128 strength§ 120.54(a)(5)(iii) | The vendor names a FIPS 140-2 or 140-3 validated module. |
| Not intentionally sent to a person in, or stored in, a § 126.1 country§ 120.54(a)(5)(iv) | The service's storage location is known, and the recipient is not in a proscribed country. |
| Not sent from a § 126.1 country§ 120.54(a)(5)(v) | Nobody sends it while travelling in one. |
Mark it, then send it
Encryption protects the message; the marking tells the recipient what they are holding. Under 32 CFR 2002.20 a CUI banner goes at the top: the word "CUI" or "CONTROLLED", plus the category marking where the information is CUI Specified. A reply that carries a marked drawing is CUI too, and needs the same banner.
In what the five services publish, only Microsoft documents adding the marking for you: a Purview sensitivity label can stamp a header or footer on the email, though not a watermark. Kiteworks reads Office labels to decide what to encrypt, and Virtru watermarks files. For everyone else the banner is typed by the sender, which is why it is the second line of the checklist below. The full marking rules are in CUI marking requirements, and CUI training is where your people learn them.
Before you send CUI by email, cuideck.com
Tick each line before the message goes. Copy it into your SOP if it helps.
0 of 7 checked
The services, one by one
Virtru
What it is. An encryption layer that sits on top of the mail you already have: plug-ins for Gmail and Outlook encrypt the message and its attachments end to end, and access can be revoked or set to expire after sending. Its platform is FedRAMP Certified at Moderate in the FedRAMP Marketplace.
Who it fits. A shop on ordinary Microsoft 365 or Google Workspace where only a few people send or receive CUI, and the owner wants a cloud the Marketplace already shows as authorized.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent for the cloud that holds the mail | Certified (Moderate) |
| An ITAR route: US-persons-only access, or the end-to-end encryption carve-out | Carve-out stated |
| Supports 7012 incident reporting: 72 hours, 90-day images | 7012 named, 72 h not |
Checked on virtru.com, 2026-10-22
Check with the vendor before you buy.
PreVeil
What it is. End-to-end encrypted email and file sharing that runs beside your existing mailbox: you keep your address and send from Outlook, Gmail or Apple Mail, while keys stay on users' devices. PreVeil states that defense data is stored on AWS GovCloud and that the service supports 102 of the 110 NIST SP 800-171 requirements.
Who it fits. A shop that trades drawings with many subcontractors and suppliers, because outside recipients can open a free account, and that is ready to keep the equivalency evidence on file itself.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent for the cloud that holds the mail | Vendor states equivalency |
| An ITAR route: US-persons-only access, or the end-to-end encryption carve-out | Carve-out stated |
| Supports 7012 incident reporting: 72 hours, 90-day images | 7012 (c)–(g) stated |
Checked on preveil.com, 2026-10-22
Check with the vendor before you buy.
Microsoft 365 GCC High
What it is. Microsoft's government cloud for contractors that hold DoD CUI or ITAR data: Exchange Online and Outlook as usual, in a separate tenant you qualify for through Microsoft's eligibility check. Staff with access to customer content are screened for US citizenship, but Microsoft says its GCC High support is outside the accreditation boundary.
Who it fits. A shop where CUI runs through most of the company's mail, files and Teams, so moving the whole tenant is simpler than adding a second system for a few users.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent for the cloud that holds the mail | Certified (High) |
| An ITAR route: US-persons-only access, or the end-to-end encryption carve-out | ITAR terms |
| Puts a CUI banner on the message | Labels stated |
Checked on learn.microsoft.com, 2026-10-22
Kiteworks
What it is. A content platform whose secure email sends attachments as a restricted link to a file that stays on the Kiteworks server, with an Outlook plug-in, policies that encrypt only the sensitive messages, and audit logs of who opened what. Its Federal Cloud is FedRAMP Certified at Moderate in the FedRAMP Marketplace.
Who it fits. A shop that also moves large drawing sets or CAD files to primes and wants email, file sharing and transfer in one authorized system rather than three.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent for the cloud that holds the mail | Certified (Moderate) |
| FIPS-validated encryption in transit and at rest, end to end where the vendor says so | FIPS 140-3 stated |
| Supports 7012 incident reporting: 72 hours, 90-day images | Not stated |
Checked on kiteworks.com, 2026-10-22
Check with the vendor before you buy.
Google Workspace
What it is. Gmail and the rest of Workspace, configured for defense work: Google says CMMC use needs its FedRAMP High services plus Assured Controls Plus to keep data in the United States, and its client-side encryption can meet the ITAR carve-out. Gmail and Vault are on the FedRAMP High service list.
Who it fits. A shop already on Google that would rather tighten its own tenant than move to Microsoft, and can buy the edition that carries client-side encryption.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent for the cloud that holds the mail | Certified (High) |
| An ITAR route: US-persons-only access, or the end-to-end encryption carve-out | Carve-out stated |
| Supports 7012 incident reporting: 72 hours, 90-day images | 72-hour notice only |
Checked on cloud.google.com, 2026-10-22
Check with the vendor before you buy.
How we read the services
What shops ask about CUI email
Can I send CUI from ordinary Microsoft 365 or Gmail?
Not as the vendors set them up for everyone else. Microsoft's own documentation points contractors holding DoD CUI or ITAR data to GCC High, and Google says CMMC use of Workspace needs its FedRAMP High services plus Assured Controls Plus. The other way is to leave ordinary mail for ordinary work and give the people who handle CUI an encrypted add-on.
Does a vendor's FedRAMP equivalency claim count?
It can. DFARS 252.204-7012 asks for security equivalent to the FedRAMP Moderate baseline, not for a listing. The DoD CIO memo of 2023-12-21 sets the bar: 100 percent of the Moderate baseline, assessed by a FedRAMP-recognized 3PAO, with the body of evidence given to you. Ask for that evidence before you sign, and keep it with your SSP. FedRAMP Moderate equivalency explained.
Isn't TLS encryption enough?
TLS protects a message while it moves between two servers that both use it. It does nothing for the copies sitting in each mailbox, which is why the rule also asks about the provider that stores them, and why 3.13.11 wants the cryptography FIPS-validated. For ITAR data, TLS alone does not meet the end-to-end definition in 22 CFR 120.54, because the provider can read the message at each end.
Do I need GCC High to email ITAR drawings?
No single product is required. ITAR lets you either keep the readers to screened US persons, or encrypt end to end so that sending and storing is not an export under 22 CFR 120.54. GCC High takes the first route; PreVeil, Virtru and Google's client-side encryption state the second. Both routes, side by side.
A prime emails CUI to my ordinary inbox. Is that my problem?
Once it lands, yes: your mail provider now stores it, so your mailbox is inside your boundary whether you planned it or not. Ask the prime to use its own secure portal or encrypted service, or give them an address on yours. Mapping where CUI already arrives is the first step of the scoping worksheet.
Does any of this matter while CMMC Phase 2 is suspended?
Yes. The suspension stops contracts adding the third-party assessments; DFARS 252.204-7012, with its cloud and incident-reporting rules, still applies, and so does NIST SP 800-171 Rev 2. What still applies today.