What Is a FedRAMP Cloud File Transfer Service?

A FedRAMP cloud file transfer service is a cloud platform for sending, receiving, and storing files that has been independently assessed and authorized to handle U.S. federal government data. If you share sensitive government information, such as Controlled Unclassified Information (CUI), a FedRAMP authorized platform is often a contract requirement, not just a best practice.

Email attachments, consumer file-sharing apps, and self-hosted FTP servers were not built for federal security standards. They often lack strong encryption, detailed audit trails, or the continuous monitoring federal agencies expect. A FedRAMP authorized file transfer service closes those gaps with security controls that have already been tested and approved.

This guide explains what FedRAMP is, what FedRAMP 20x changes, why a CUI enclave only works when every building block that touches CUI meets the same bar, and how to choose the right provider.

What is FedRAMP?

The Federal Risk and Authorization Management Program (FedRAMP) is the U.S. government's standard program for assessing and authorizing cloud services. It launched in 2011 and is run by the General Services Administration (GSA). Its goal is simple: assess a cloud service once, then let many agencies reuse that work.

Before FedRAMP, each agency ran its own security review for every cloud vendor. That was slow, expensive, and inconsistent. FedRAMP replaced it with one baseline of security controls, based on NIST SP 800-53. Independent Third Party Assessment Organizations (3PAOs) test providers against that baseline.

Federal agencies must use FedRAMP authorized services when they put federal data in the cloud. Contractors that handle federal information, especially in defense, often face the same expectation through their contracts.

FedRAMP is also changing. Under the FedRAMP Consolidated Rules that took effect in July 2026, "FedRAMP Authorization" is now called "FedRAMP Certification," and the Low, Moderate, and High baselines map to Certification Classes B, C, and D. The core idea stays the same: the service has been independently tested and approved for federal data. The next section explains the other big change, FedRAMP 20x.

What is FedRAMP 20x?

FedRAMP 20x is the program's newer way to assess and certify cloud services. FedRAMP describes it as an approach "that moves beyond traditional compliance to focus on the security decisions that matter most." Providers set their own security goals, measure how well their decisions work, and assure agencies through progressively increasing commitments.

The practical difference is in how the proof is gathered. Under the traditional Rev 5 path, a 3PAO assesses a provider control by control against the NIST SP 800-53 Rev 5 baseline. 20x organizes assessment around Key Security Indicators (KSIs): short outcome statements, many of which say a protection must be maintained "persistently," that map back to the related NIST 800-53 controls and are validated with automation wherever possible.

20x is rolling out in phases. Phase 1 piloted the Low baseline. Phase 2 piloted Moderate and ended in March 2026, with the first pilot authorizations issued on March 6, 2026. FedRAMP's 20x page currently lists Phase 3 as active, supporting Class A (pilot), Class B (Low), and Class C (Moderate) certifications. A Class D (High) pilot is planned for a later phase.

Rev 5 has not disappeared, but FedRAMP now labels it "Legacy," and its published timeline says FedRAMP will stop accepting applications for new Rev 5 certifications on June 11, 2027.

"Class C" now comes in two kinds

Under the 2026 rules, "Class C" appears on both paths. Rev 5 Class C and 20x Class C are separate rule sets. The class tells you the impact level (Class C is Moderate). The certification type tells you how the service was assessed. Two providers can both say "FedRAMP Moderate" and have been through different processes, so ask which one a vendor holds.

What 20x does not settle yet

DFARS 252.204-7012 asks for cloud services that handle CUI to meet the FedRAMP Moderate baseline. That clause was written long before 20x existed, and FedRAMP's own pages do not say how DoD or CMMC assessors will treat a 20x certification. If you are a defense contractor, do not assume. Ask your C3PAO or contracting officer to confirm in writing which certification types they accept for your contract. Rev 5 Class C is the established path today.

What makes a file transfer service "FedRAMP authorized"?

A cloud file transfer service is FedRAMP authorized when it has passed a 3PAO assessment, received an authorization, and is listed on the FedRAMP Marketplace. The authorization covers a defined system boundary: the specific product, infrastructure, and processes that were assessed. A provider's other products are not covered automatically.

FedRAMP sorts services by impact level, based on how much harm a data breach could cause. Most file transfer services built for government and defense work are authorized at FedRAMP Moderate (now Class C), which covers most CUI.

Authorized vs. "equivalent"

You may also see vendors claim to be "FedRAMP Moderate Equivalent." That is not the same thing. An equivalent service is not FedRAMP authorized and does not appear on the Marketplace as authorized. Instead, it claims to meet the Moderate baseline through the DoD equivalency process for DFARS 252.204-7012. That puts more of the documentation and review burden on you, the customer. A FedRAMP authorized service has already been reviewed and approved by the government. For a deeper look, read FedRAMP Authorized vs. FedRAMP Equivalent.

Why a CUI enclave needs every building block to meet the same bar

Many defense contractors shrink their CMMC scope by building a CUI enclave: a dedicated environment where CUI is stored, processed, and transmitted, so the rest of the company's IT stays out of scope. It is a sound strategy, but it only works if everything inside the enclave holds up.

The rule that matters is in DFARS 252.204-7012(b)(2)(ii)(D). If a contractor uses an external cloud service provider to store, process, or transmit covered defense information, that provider must meet security requirements equivalent to the FedRAMP Moderate baseline. The requirement is not limited to the cloud where the enclave runs. It applies to every external service in the CUI path.

A typical enclave is made of several building blocks:

• • Hosting and infrastructure where the enclave runs.

  • Collaboration and storage tools where people work with CUI.

  • Identity and multi-factor authentication that control who gets in.

  • Email and messaging that carry CUI.

  • Backup and logging that hold copies of CUI or records about it.

  • File transfer in and out that moves CUI across the enclave boundary.

Each block that touches CUI is in scope. One weak link, such as a commercial file-sharing tool or an unmanaged SFTP server, leaves a hole in the boundary no matter how strong the rest of the enclave is.

The door in and out is the part teams forget

CUI rarely starts inside your enclave. Primes send drawings, subcontractors return deliverables, and customers share specifications. Every one of those files has to cross the boundary, and the shortcuts people reach for are email attachments, consumer file-sharing apps, and a self-hosted FTP server with no FedRAMP assessment behind it.

A file transfer service sits directly in the CUI path, so it needs the same compliance as the rest of the enclave. It is not a side tool. It is the front door.

Where Sharetru Federal fits

Sharetru Federal is a cloud file transfer service you can put at that front door. It is FedRAMP Rev 5 (Class C) Certified, the new name for FedRAMP Moderate, and it covers the whole stack in one boundary: the infrastructure (IaaS), the platform (PaaS), and the file transfer application itself (SaaS). That boundary is the package originally authorized by the Joint Authorization Board (JAB) and operated with MIS Sciences, and Sharetru Federal runs inside it. For an enclave, that means one boundary to document and one Customer Responsibility Matrix to read, instead of stitching together separate evidence for each layer.

What you get at the boundary:

• • FedRAMP Moderate, Rev 5 (Class C). Listed on the FedRAMP Marketplace, so you can verify it yourself.

  • FIPS 140-3 validated cryptography and TLS 1.3 for data in transit and at rest.

  • U.S. data storage. Customer data stays in the United States.

  • 12 months of activity log history showing who uploaded, downloaded, shared, or deleted what.

  • Easy for outside partners and automation. A browser-based web app for partners, plus SFTP and a REST API for automated transfers.

  • Strong access control. Authenticator-app multi-factor sign-in, allowed IP ranges and protocol restrictions, and optional dynamic watermarking of files viewed in the browser.

Sharetru sells both Sharetru Commercial and Sharetru Federal. The FedRAMP boundary covers Sharetru Federal, so that is the one for CUI.

It is also worth being clear about what a file transfer service does and does not do. Sharetru Federal secures the transfer and storage inside its boundary. It does not open, inspect, or label your files, so you decide what is CUI. And it does not extend its protection to files after you move them into another system, which is why the enclave on the other end needs to meet the same standard.

Core security capabilities to expect

A FedRAMP authorized file transfer service should give you these protections out of the box:

• • FIPS validated encryption. Data is encrypted in transit (TLS 1.2 or higher, ideally TLS 1.3) and at rest, using FIPS 140-2 or 140-3 validated cryptographic modules.

  • Strong identity and access control. Multi-factor authentication, role-based permissions, and single sign-on so only the right people reach the right files.

  • Detailed audit logging. A record of who uploaded, downloaded, shared, or deleted each file, and when. This is essential for incident response and compliance audits.

  • U.S. data residency. Data stays in U.S. data centers, often managed by U.S. persons, which matters for ITAR and export-controlled data.

  • Continuous monitoring. The provider sends monthly vulnerability scans and security reports to the government and is reassessed every year, so the authorization reflects current security.

  • Incident response. Documented procedures for detecting, reporting, and containing security incidents within required timelines.

  • Secure transfer options. Web-based sharing plus protocols such as SFTP and FTPS, and often APIs for automated managed file transfer (MFT) workflows.

Who needs a FedRAMP cloud file transfer service?

Any organization that stores or shares federal data in the cloud should consider one. The most common groups are:

• • Federal agencies. Agencies are required to use FedRAMP authorized cloud services for federal data.

  • Defense contractors and subcontractors. Under DFARS 252.204-7012, contractors that store CUI with a cloud provider must use a service that meets the FedRAMP Moderate baseline. A FedRAMP Moderate authorized service is the most direct way to meet that rule.

  • Organizations preparing for CMMC. In July 2026, DoD suspended CMMC Phase 2 third-party certification requirements while a reform task force reviews the program. That pause did not change DFARS 7012 or your obligation to protect CUI. Contractors who keep using CUI-ready tools now will be ready for whatever version of CMMC comes next.

  • State and local government, universities, and research labs. Many handle federally funded or federally regulated data and adopt FedRAMP authorized tools to meet grant or partner requirements.

  • Regulated industries. Aerospace, manufacturing, healthcare, and financial services teams that work with government partners often standardize on FedRAMP authorized platforms.

If you exchange technical drawings, contracts, export-controlled data, or other CUI with the government or a prime contractor, you likely need one.

How to evaluate a FedRAMP file transfer provider

Start by checking the FedRAMP Marketplace. It is the official source of truth. Then work through these questions:

1. Is the exact product authorized? Confirm that the product you are buying is the one listed. Many vendors sell commercial and federal versions, and only the federal version may be inside the FedRAMP boundary.
2. At what class, and on which path? For CUI, look for FedRAMP Moderate (Class C) or higher, and note whether the certification is Rev 5 or 20x. If you are a defense contractor, confirm with your C3PAO or contracting officer that your path is accepted.
3. Does the boundary cover the whole stack? Ask whether the infrastructure, the platform, and the application are all inside the certified boundary, or whether some layers rely on separate services you would have to evaluate yourself.
4. Is it authorized or just "equivalent"? Ask for the Marketplace listing, not just a claim of equivalency.
5. Does every other part of your enclave meet the same bar? The file transfer service, the hosting, the collaboration tools, and anything else that touches CUI are held to the same standard.
6. What is your shared responsibility? Request the Customer Responsibility Matrix (CRM) so you know which controls you still own, such as user management.
7. Does it fit your workflows? Check support for web sharing, SFTP and FTPS, APIs, automation, and integrations with your identity provider.
8. Is it easy to use? Partners and subcontractors will skip a secure tool that is hard to use. Look for a simple interface and fast onboarding for external users.
9. What support do you get? Look for U.S.-based support and help with audits and assessments.
10. What does it really cost? Compare pricing models, storage limits, and user fees, not just the entry price.

Frequently asked questions

What is FedRAMP 20x?

FedRAMP 20x is a newer certification path built around outcome-based Key Security Indicators and automated validation, instead of the control-by-control assessment used on the Rev 5 path. It is rolling out in phases, and Class C (Moderate) is supported in the current phase.

Is a 20x Class C certification the same as FedRAMP Moderate?

FedRAMP maps 20x Class C to the Moderate impact level, just as it does for Rev 5 Class C. The two are assessed differently. Whether DoD treats them the same for DFARS 252.204-7012 is not addressed in FedRAMP's own pages, so confirm with your C3PAO or contracting officer before you rely on it.

Is Rev 5 going away?

FedRAMP now labels Rev 5 "Legacy," and its timeline ends applications for new Rev 5 certifications on June 11, 2027. Services that are certified through Rev 5 today are still listed, so check the Marketplace for current status.

Do I need a FedRAMP service if I have a CUI enclave?

Yes, for every external cloud service in the CUI path. The enclave reduces your scope, but DFARS 252.204-7012 still requires any external cloud service provider that stores, processes, or transmits CUI to meet the FedRAMP Moderate baseline. That includes the service you use to move files in and out.

Is a FedRAMP file transfer service the same as managed file transfer (MFT)?

Not always. MFT describes features like automation, scheduling, and protocol support. FedRAMP describes the security authorization. A FedRAMP authorized MFT platform combines both.

Is FedRAMP required for CMMC?

CMMC does not require FedRAMP directly. However, DFARS 252.204-7012 requires cloud services that store CUI to meet the FedRAMP Moderate baseline, and that clause still applies while CMMC Phase 2 is paused. Using a FedRAMP Moderate authorized service is the simplest way to show compliance.

Can I use a commercial file sharing tool for CUI?

Only if that specific service is FedRAMP Moderate authorized or can prove equivalency. Most consumer and standard business tiers are not.

How do I verify a vendor's FedRAMP status?

Search for the product on the FedRAMP Marketplace. If it is not listed as authorized, ask the vendor to explain why.

Does FedRAMP cover ITAR data?

FedRAMP and ITAR are separate requirements. FedRAMP Moderate controls help, but ITAR also requires U.S. data residency and limits on foreign-person access. Confirm both with your provider.

The bottom line

A FedRAMP cloud file transfer service lets you share sensitive government data with security controls the federal government has already tested and approved. It cuts your compliance burden, makes audits easier, and gives agencies and prime contractors confidence that their data is protected. If you run a CUI enclave, the same rule applies to every building block in it, and the file transfer service at the boundary is the one most teams overlook.

Sharetru Federal is FedRAMP Rev 5 (Class C) Certified, the new name for FedRAMP Moderate, not just "FedRAMP equivalent." It is a secure file sharing and managed file transfer platform built for defense contractors, government agencies, and regulated industries, with the infrastructure, platform, and application inside one FedRAMP boundary, FIPS 140-3 validated encryption, TLS 1.3, detailed audit logging, and the simple experience your partners need to actually use it.

Schedule a demo to see how Sharetru Federal helps you meet FedRAMP and DFARS requirements and protect CU