An independent third-party assessment organization recently evaluated Google Cloud’s security controls and found that Google Cloud successfully enables compliance with v6.0 of the CJIS Security Policy. 

If requested by a customer or state CJIS Systems Agency (CSA), Google Cloud will execute a Management Agreement that provides customers with detailed information on how Google Cloud enables compliance with the CJIS Security Policy, the responsibilities of each party, which cloud services are covered, and many other important provisions. You can request a copy of the Google Cloud CJIS Management Agreement by emailing cjis@google.com.

The Google Cloud compliance team can also provide detailed compliance narratives demonstrating how Google Cloud satisfies CJISSECPOL requirements applicable to Cloud Service Providers.

Yes. Google Cloud enables customers to restrict CJIS workloads to US-only regions through Assured Workloads and Assured Controls. Google will store your data at rest in accordance with our Service Specific Terms.

Google works with state CSAs (or local agencies) to ensure Google personnel who may have unescorted access to a state’s unencrypted CJI undergo fingerprint-based background checks consistent with the CJIS Security Policy. In-scope Google personnel will submit FD-258 fingerprint cards, along with any required documentation, to each CSA or local agency.

This process ensures that in-scope personnel will be granted unescorted access to unencrypted CJI only after completing the fingerprint-based background check, completing CJIS Security Awareness training, and signing the CJIS Security Addendum.

Google has implemented zero trust at the core of our services and our operations; our infrastructure does not assume any trust between the services that are running on it. In other words, every resource access request is inspected, authenticated, and verified as if it originates from an untrusted network.

Customer environments within Google Cloud are also logically segregated to prevent users and customers from accessing resources not assigned to them. Customer data (including CJI) is logically segregated by domain to allow data to be produced for a single tenant. The ability of Google Cloud to protect customer data in this manner, while also allowing for more rapid feature development and customer cost benefits, makes it the better choice for government customers.

Yes - Google Cloud uses a FIPS 140-3 validated encryption module called BoringCrypto (certificate 4735) in our production environment. Google Cloud encrypts all customer content stored at rest and in transit between our facilities, without any action required from the customer, using one or more encryption mechanisms. 

This allows customers to maintain compliance with the CJIS Security Policy while choosing from a variety of Cloud Key Management offerings such as Google Managed Keys, Customer Managed Encryptions Keys, and External Key Management. Since Google Cloud uses this level of encryption by default for data at rest and in transit, customers can inherit FIPS 140-3 validated encryption and eliminate the requirement to run products and services in FIPS mode.

No. Since Google provides customer managed encryption keys and restricts unescorted access to unencrypted CJI to CJIS-scoped personnel that have been appropriately screened, confidential computing is not required for CJIS on Google Cloud. However, customers can choose to utilize confidential computing on top of the secure and restricted CJIS Data Boundary.

The CJIS Security Policy does not require the use of a Government Cloud (‘GovCloud’) and there is no definition in the CJIS Security Policy or standard regarding what constitutes a GovCloud. Google Cloud’s CJIS Data Boundary supports customer compliance with the CJIS Security Policy and Google Cloud’s compliance has been validated by an independent third-party assessment organization and numerous state CSAs. 

Google has invested in a layered security approach to its public cloud infrastructure, providing features like encryption and strong personnel data access controls. This, along with the zero-trust implementation described above, provides the strong security posture required to meet the stringent requirements of the CJIS Security Policy while also enabling customers to leverage the ongoing product innovations of public cloud.

Google’s implementation of the aforementioned controls (and many others) complies with FedRAMP Moderate and FedRAMP High requirements and has been recognized by the Joint Authorization Board (JAB). 

We see validation of our approach in Office of Management and Budget (OMB) Memo M-24-15 (‘Modernizing the Federal Risk and Authorization Management Program (FedRAMP)’), which recommends federal agencies move away from isolated GovCloud architectures:

“FedRAMP should not incentivize or require commercial cloud providers to create separate, dedicated offerings for Federal use, whether through its application of Federal security frameworks or other program operations. The Federal Government benefits from the investment, security maintenance, and rapid feature development that commercial cloud providers give to their core products to succeed in the marketplace. Commercial providers similarly are incentivized to integrate improved security practices that emerge from their engagement with FedRAMP into their core services, benefiting all customers.”

Yes, Google Cloud customers own their customer data when using Google Cloud or Google Workspace. See the Cloud Data Processing Addendum (CDPA) and our Privacy Resource Center for details on our data processing commitments.