This document provides technical guidance for US Federal agencies and DoD departments on deploying andusing Gemini for Government in compliance with FedRAMP High and DoD ImpactLevel 4 (IL4) requirements. This document describes which services and featuresare included in the authorization boundaries and the steps to help you meet yourcompliance obligations.

Gemini for Government usesAssured Workloads to help withcompliance requirements. You must deploy all Gemini for Government resourceswithin an Assured Workloads folder that's configured for yourspecific compliance regime (FedRAMP High or IL4).

Core product dependencies

Gemini for Government relies on severalGoogle Cloud services. The following table lists thecompliance status for each service.

Google Cloud service	FedRAMP High status	IL4 status
Gemini Enterprise	Authorized	Authorized
Generative AI on Vertex AI	Authorized	Authorized
BigQuery	Authorized	Authorized
Cloud Storage	Authorized	Authorized
Looker (Google Cloud core)	Authorized	Submitted

Note: Because Looker (Google Cloud core) isn't yet IL4authorized, dependent features like Gemini inLooker aren't authorized for IL4, as described inUnauthorizedfeatures that you should disable manually.

Authorized services and features

The following table lists the services and features that you can usewithin Gemini for Government for FedRAMP High and IL4 deployments.

Feature	FedRAMP High	IL4
Generallyavailable Gemini models	Authorized	Authorized
Autocomplete	Authorized	Authorized
Servingcontrols	Authorized	Authorized
Authorized data stores such asCloud Storage andBigQuery	Authorized	Authorized
WebGrounding for Enterprise	Authorized	Authorized
Uploadingdocuments from local machines	Authorized	Authorized
Ability for end users toselectmodels	Authorized	Authorized
Deep Research agent	Authorized	Submitted
No-code agent creation usingAgent Designer	Authorized	Submitted

Unauthorized features that you should disable manually

The following services and features aren't authorized for FedRAMP High or IL4.However, they aren't blocked by the Assured Workloads controlpackages and are available in your project. As part of your risk assessment, you may need to carefully assess service usage relative to sensitive data and any mitigating controls available to you. You may need to manually disable the features on this list in your GeminiEnterprise application configuration based on your assessment.

Agents and galleries	Agentsgallery Promptgallery
Grounding	Groundingwith Google Maps Platform Groundingwith Google Search Grounding using Google Drive uploads Grounding using Microsoft OneDrive uploads
Generative features	Generate images usingImagen Generate video withVeo
User, session, and UI features	Userevents for Gemini Enterprise apps Conversationsharing Personalizationand memory in Gemini Enterprise
Other features	PrivateKnowledge Graph in Gemini Enterprise Model Armor NotebookLMEnterprise Implicitcontext caching

For more information about implicit context caching, seeVertex AI andzero dataretention.

Unauthorized features that you can't disable

The following services and features are available in theAssured Workloads control package. You can't disable them. If you do usethese features, you should conduct a proper risk assessment prior to granting your authorization to make sure service usage is appropriate for your FedRAMP High or IL4 deployment. For example, you could assess service usage relative to data sensitivity. You could also evaluate if any mitigating controls based on data encryption are available to you to establish sole control over data access.

Agents and galleries	DataInsights agent IdeaGeneration agent To remove availability for these agents, contact oursales team or your Google Cloud representative.
Analytics and dependent features	Viewanalytics data Dataagent context for Looker data sources Dataagent context for BigQuery data sources Dataagents that you create using the Conversational Analytics API Geminiin BigQuery Geminiin Looker
Data connectors and stores	Google Workspace data sources such as Google Drive, Gmail, or Google Calendar Google Cloud data stores such as Cloud SQL and Firestore Google Calendar and Gmail actions Third-party data sources such as Salesforce or Microsoft People data sources such asGoogle Workspace,MicrosoftEntra, orcustomsources
User, session, and UI features	Promptchips
Other features	Gemini Code Assist

Deploy your environment

Follow these steps for assistance with deploying an environment that meets your compliance obligations:

1. Deploy Assured Workloads:
   1. Create an Assured Workloadsfolder that uses Data Boundaryfor FedRAMP High or Data Boundary for IL4.
   2. Create your Google Cloud projectinside this folder.
   3. Verify that all users and service accountshave the required Identity and Access Management (IAM) permissions.
2. Create aGemini Enterpriseapp. SelectUS Multi-region as the location. The Assured Workloads dataresidency policy enforces this option.

3. Connect to aGoogle data sourcethat's located within your Assured Workloads folder. Theauthorized data stores for FedRAMP High and IL4 are Cloud Storagebuckets and BigQuery datasets.

   Note: Don't connect to anunauthorized data source (for example, Cloud SQL or Google Drive)or a resource that's outside your Assured Workloads folder.

4. Configure authorized compliance features.

5. Turn off the unauthorized features that are described inunauthorized features that you should disable manually.

6. Train your personnel not to useunauthorized features that you can'tdisable.