CMMC Email Deployment Guide

This guide provides steps for deploying XQ’s email extensions for CMMC users.

Note

Who this guide is for: teams that require FIPS-validated encryption, which includes anyone meeting CMMC Level 2. If FIPS mode is off for your team, use Email Installation for Admins instead.

CMMC customers must deploy XQ’s Secure Email extensions in a specific way to ensure they meet Federal Information Processing Standards Publication (FIPS) security standards.

FIPS are standards and guidelines for federal computer systems established by the National Institute of Standards and Technology (NIST). These standards ensure the security and reliability of information technology (IT) products and services used by the government. FIPS standards must be met to ensure CMMC compliance.

Note

Note: The following steps are intended to be performed by an administrator. Administrators must set up XQ Vault and Email in a specific way that meets CMMC compliance.

Caution

When FIPS mode is on:

• Send encrypted email from Edge or Chrome: Outlook on the web, Outlook installed as a web app (PWA), or Gmail.
• Encrypted emails sent from the Outlook desktop app aren’t encrypted, so they aren’t sent.
• XQ encryption isn’t available in the Outlook or Gmail mobile apps.
• Send Without Encryption always sends plain text, from any client. Make sure users know not to use it for CUI.

1. Create an XQ account and add all team members.

2. Ensure all team members use a Chromium-Based browser. Chromium-Based browsers must be used because a Chrome Extension is used for FIPS validated encryption. Other browsers may not allow for FIPS validated encryption and will not meet CMMC requirements.

   • We recommend using Microsoft Edge or Google Chrome.

3. Install both FIPS components on every computer your team uses:

   • XQ FIPS Helper application, installed on the computer. It contains the FIPS-validated encryption library.
   • XQ FIPS Helper extension, installed in Edge or Chrome. It lets the XQ Outlook Enterprise add-in or the XQ Secure Gmail extension pass encryption to the helper application on the device.

   For installation steps, see How to Install the XQ FIPS Helper Application for Windows or How to Install the XQ FIPS Helper Application for MacOS.

4. Deploy XQ Email:

   • Outlook: deploy the add-in, the same add-in every XQ Email customer uses. We recommend a Microsoft 365 Group install; users can also install it from Outlook on the web. A group install also adds the add-in to the Outlook desktop app, where encrypted emails won’t send while FIPS mode is on.
   • Gmail: install the XQ Secure Gmail extension, or deploy it to your Google group.

5. TIP: If you are installing the add-in, we recommend installing Outlook as a progressive web app (PWA) in Microsoft Edge or Google Chrome. With the Outlook PWA, you can pin and launch the web version of Outlook from your computer’s home screen or taskbar and access your account while you’re offline. This provides the look and feel of Outlook’s desktop application, but is still CMMC compliant because it runs off your Chromium-Based browser. For instructions on installing Outlook as a progressive web app, see Use the web version of Outlook like a desktop app.

6. Turn on FIPS mode in your XQ Security settings.

7. Ensure users are signed in to the add-in with the correct team—the team name always shows up on the add-in’s Settings panel.

8. Create Data Loss Prevention And Data Access Control Policies.