Skip to content
Documentation

Google Workspace & Google Cloud

What this guide covers

How to actually buy Google Workspace productivity and Google Cloud Platform (GCP) for a Maryland agency — which statewide vehicle you ride, which reseller fulfills the order, the FedRAMP/ATO path (and why Workspace needs no separate government instance while GCP coverage is per-service), and the functionality gates to clear before you sign.

Who it’s for

Engineering leads, program staff, and procurement officers at a Maryland State agency or education entity who have decided they need Google Workspace productivity, GCP infrastructure, or both, and need the path from “we want it” to “it’s authorized and on contract.”

Part of the SaaS Catalog. For the vehicles themselves, see Maryland Master Contracts; for the process and thresholds, see Maryland Procurement.

Disclaimer. Not legal or procurement advice. FedRAMP authorizations, contract catalogs, and BPO numbers change as awards are renewed and authorizations are re-baselined. Verify every figure below against the FedRAMP Marketplace, the Google Cloud FedRAMP compliance page, and the DoIT Statewide Contracts hub before relying on it. GCP’s FedRAMP High coverage is per-service, not blanket — see Authorization and ATO.

TL;DR

  • Category: Cloud platform — Google Workspace productivity (Gmail, Docs, Drive, Meet) plus GCP IaaS/PaaS.
  • Maryland vehicle: NASPO ValuePoint Cloud Solutions MD addendum via Carahsoft (master agreement AR2472) — Google is confirmed on the MD NASPO addendum — and also on COTS 2012 (BPO 060B2490021).
  • Reseller: Carahsoft (Google’s primary public-sector distributor); SADA and Insight are alternates.
  • Authorization: Google Workspace is FedRAMP High on the public/commercial offering — no separate gov instance needed. GCP is FedRAMP High P-ATO across 150+ services; key services also DoD IL4 via Assured Workloads. GovRAMP status unverified.
  • The ATO trap: GCP High coverage is per-service, not blanket — and enforcing residency/personnel controls requires Assured Workloads. Confirm each service you use is in scope.

What This Tool Is

Google Workspace and GCP are two products bought as one relationship: Workspace is the managed productivity suite (Gmail, Docs, Drive, Meet, Calendar), and GCP is the IaaS/PaaS cloud (compute, storage, BigQuery, managed databases, and a broad services catalog). Agencies reach for them when they want Google’s integrated productivity-plus-infrastructure stack rather than assembling it themselves. The self-hostable infrastructure alternative is the Kubernetes/Postgres/MinIO stack from Tools and Software → Infrastructure, but that substitutes only for the GCP IaaS layer — there is no drop-in OSS swap for the Workspace productivity suite, so for most agencies this is a procurement-and-ATO exercise.

Which Maryland Vehicle

VehicleIdentifierHow Google rides it
NASPO ValuePoint Cloud Solutions (MD participating addendum, Carahsoft)Carahsoft master agreement AR2472The primary path — Google is confirmed on the Maryland NASPO addendum publisher list.
COTS 2012 (via Carahsoft)060B2490021An alternative path — Google is also reachable on the COTS master contract. Compare ceiling pricing and terms before choosing.

The same publisher can be reachable through more than one Carahsoft vehicle, and which one you ride affects ceiling pricing, terms, and which approvals apply — see Maryland Master Contracts → Where Carahsoft Fits.

Resellers and Pricing Path

Carahsoft is Google’s primary public-sector distributor and the reseller holding the Maryland awards; SADA and Insight are common alternates. You do not buy a “Carahsoft contract” — Carahsoft fulfills your order against the NASPO Cloud addendum (or COTS). Request a quote referencing the Maryland vehicle (NASPO Cloud addendum or COTS BPO 060B2490021) so the order is priced against the statewide ceiling rather than commercial list price. Workspace is seat-metered (per-user, by edition) and GCP is usage-metered across services, so size both the seat count and the expected GCP consumption before you ask — and revisit, because usage-based bills drift upward.

Authorization and ATO

OfferingFedRAMP / DoD statusNote
Google WorkspaceFedRAMP HighOn the public/commercial offering — no separate government instance needed.
Google Cloud Platform (GCP)FedRAMP High P-ATO across 150+ services; key services also DoD IL4Coverage is per-service; IL4 and residency/personnel controls run through Assured Workloads.
GovRAMPUnverifiedConfirm on the GovRAMP product list.

The single thing to get right for the ATO: GCP’s FedRAMP High coverage is per-service, not blanket — the 150+ in-scope services are a list, not the whole platform, so confirm each GCP service you intend to use is actually in scope at the impact level you need. And enforcing data-residency and personnel controls requires Assured Workloads, which you must explicitly configure; a plain GCP project does not enforce them. Google Workspace is simpler — its FedRAMP High authorization attaches to the public/commercial offering, so there is no separate “government Workspace” to provision — but still confirm the current baseline on the Marketplace before you commit.

Functionality Gates to Verify

Clear these before price comparison — any one can disqualify the buy regardless of cost. See the canonical list in Tools and Software → Enterprise Functionality.

GateGoogle-specific note
SSO (SAML/OIDC) + SCIMWorkspace is itself an identity provider and also federates to an external IdP; SCIM provisioning supported.
Audit logsAdmin and Cloud audit logs available; confirm retention and export meet your records policy.
RBACGranular IAM roles across Workspace and GCP; map to least-privilege before rollout.
Data residency / FedRAMP boundaryWorkspace High covers the commercial offering; GCP residency runs through Assured Workloads — and GCP scope is per-service.
Accessibility (VPAT/ACR)Request Google’s current VPAT; Maryland’s Nonvisual Access (NVA) requirement applies to the procurement.
BAA / DPAAvailable; required if any data could carry PII/PHI — confirm for the specific offering you buy.

Procurement Steps

  1. Confirm the need over the alternative. GCP IaaS overlaps the self-hostable Kubernetes/Postgres/MinIO stack ($0 license); Workspace productivity has no OSS drop-in. Document why managed is worth the spend — that rationale is the core of the budget justification.
  2. Register / confirm eMMA. Your agency and the reseller must be set up in eMMA.
  3. Pick the vehicle. Default to the NASPO ValuePoint Cloud Solutions MD addendum (Carahsoft, AR2472), where Google is confirmed; compare COTS 060B2490021 if its terms suit you better.
  4. Get a Carahsoft quote referencing the vehicle, sized to your seat count and expected GCP consumption, for the specific services you need (confirm GCP service-level FedRAMP scope and whether Assured Workloads is required).
  5. Check the threshold. The order’s dollar value drives the method. See Maryland Procurement → how the value picks the path. Do not split a buy to dodge a threshold.
  6. Run the ATO package. Inherit the FedRAMP controls for Workspace and for the in-scope GCP services — verify per-service scope and configure Assured Workloads first.
  7. Issue the order against the vehicle once approvals clear.

Sources

ClaimSource
Workspace FedRAMP High; GCP DoD IL4 via Assured WorkloadsGoogle Cloud — Workspace earns FedRAMP High, GCP services receive DoD IL4
GCP FedRAMP High P-ATO across 150+ services (per-service scope)Google Cloud — FedRAMP compliance
Google Workspace FedRAMP High authorizationFedScoop — Google Workspace receives FedRAMP High

GCP’s FedRAMP High coverage is per-service, not blanket, and GovRAMP status is unverified. Confirm each GCP service’s scope and the current GovRAMP listing before relying on any figure here.