CMMC Level 2 · CUI file sharing and transfer
Share CUI with primes and suppliers. Keep access controlled and exchanges documented.
Sharetru Federal is where controlled files cross your boundary: browser sharing for the people you work with, system transfers for the jobs you already run, and the assessment documentation your assessor and your prime ask for. It is FedRAMP Moderate Certified, package F1311222650, and its responsibility matrix covers all of NIST SP 800-171 Rev 2.
15‑day free trial on the certified environment · U.S. persons, U.S. soil
Reviewing before anyone opens an account? See who covers what
Browser sharing
System transfers
Assessment documentation
Illustrative settings view. On Sharetru Federal, plain FTP is not offered and email and SMS codes are off.
Where Sharetru Federal fits
When controlled files need to move beyond your internal systems
Four situations bring defense suppliers to Sharetru Federal, whether this is a first assessment or a tool being replaced after a third. Each has a different owner. One site handles all four.
Same site, same rules, same record: the people you share with, the systems you transfer with, and the evidence your assessor reads.
See a CUI exchange-
A prime’s questionnaire
A prime asks how you protect the CUI it sends you
The subcontract carries DFARS 252.204-7012, and the questionnaire asks which cloud service holds the files and who assessed it.
Answered by the FedRAMP Marketplace listing and a responsibility matrix for all of NIST SP 800-171 Rev 2, which comes with a trial. Who covers what
-
Drawings out, records back
Drawings go out to suppliers. Inspection records come back.
Your enclave, Microsoft 365 GCC High included, is closed to outside domains by policy, and the supplier still needs the drawing.
Answered by links that open only for the named recipient when Sharetru sends them, view-only drawings with a watermark, and upload-only links for what comes back. The exchange
-
Replacing a transfer server
An SFTP server that moves CUI is in scope for the assessment
Every requirement on it, from FIPS-validated encryption to log retention, is yours to prove. The scripts, schedulers, service accounts and partners that use it cannot stop for a cutover.
Answered by SFTP, FTPS, SCP and the REST API on the certified service. Each job is repointed and runs beside the old server until the logs agree; then the server is retired. Replacing a server
-
Assessment evidence
An assessment, or a self-assessment, needs the file-sharing story in writing
The system security plan (SSP) has to name the service and say who is responsible for what, and the assessor will ask for the record of what happened to the files.
Answered by the listing, the matrix, the SOC 2 Type II report and an access log you export yourself. The evidence pack
Assessed, not self-attested
Who assessed Sharetru Federal, and at which layers?
A FedRAMP third-party assessment organization (3PAO), at all three layers: Sharetru Federal is the certified SaaS inside MIS Sciences Corporation’s GovPoint Cloud Services. Package F1311222650 is assessed against NIST SP 800-53 Rev 5, with continuous monitoring and an annual assessment, so the application your CUI touches is inside the assessed boundary, not hosted beside it.
FedRAMP’s 2026 rules call this status FedRAMP Certified (Class C), the status called “Authorized” until February 25, 2026; the DFARS clause and the CMMC rule still say “FedRAMP Moderate.” Same baseline, newer label.
F1311222650- Cloud service providerMIS Sciences Corporation
- Cloud service offeringGovPoint Cloud Services
- Service modelIaaS, PaaS, SaaS
- ClassClass C (Moderate)
- TypeRev5
- StatusFedRAMP Certified
- Certified servicesSharetru Federal
One certification, three layers
One package, assessed by a 3PAO against NIST SP 800-53 Rev 5, with continuous monitoring and an annual assessment.
What Sharetru does not hand out
The FedRAMP security package is not Sharetru’s to give you
The Body of Evidence for GovPoint (the system security plan, the assessment report, the plan of action and milestones) belongs to MIS Sciences Corporation and sits in FedRAMP’s repository, which releases it to federal agencies through the package access request. What you get instead is the public listing, the responsibility matrix and the SOC 2 Type II report. If your C3PAO, or DCMA’s DIBCAC, has questions about Sharetru Federal, we talk to your assessment team directly.
Shared responsibility
What does Sharetru cover, and what do we still own?
For CUI in Sharetru Federal, its matrix assigns all 320 NIST SP 800-171 Rev 2 objectives: 192 to Sharetru, 73 shared, 55 yours. Your own network, endpoints and people stay in your assessment. Each objective carries an implementation statement for your SSP; the full matrix comes with a trial, under NDA, and here it is by family.
The matrix is Sharetru’s crosswalk of the controls the 3PAO assessed to the 800-171A objectives: the assessment is the 3PAO’s, the mapping is ours. It is the customer responsibility matrix (CRM) that, under 32 CFR 170.19, documents your use of an external provider.
320 objectives. Every one assigned. For the CUI in Sharetru Federal · 110 requirements · 14 families
- Sharetru FederalInherited for the CUI you keep in Sharetru Federal. Your SSP points to the matrix.
- SharedSharetru carries part, and the objective’s statement says which part. You implement and document the rest.
- YoursNot inheritable. You implement, document and evidence it in your own environment.
Mostly inherited from Sharetru Federal9 families
Mostly shared4 families
Mostly yours1 family
Counts by assessment objective, from Sharetru’s responsibility matrix (v2.3, July 31, 2026). They describe Sharetru Federal’s part of your system; your own network, endpoints and people are assessed as yours. Families are grouped by where most of their objectives sit. The matrix itself, with every objective’s designation and implementation statement, comes with a trial, under the NDA in the Terms of Service.
Cite the listing in your SSP.
Name Sharetru Federal and its FedRAMP listing in the external-system section.
Carry the matrix into your control narratives.
Objective by objective: Sharetru, Shared or Yours, with its implementation statement.
Close the objectives that are yours.
The matrix lists them, and each Shared objective’s statement says which part you inherit.
Show the assessor the evidence.
The listing and your log export are yours to share, and an Auditor role lets them look for themselves. Ask us before passing on the matrix or the SOC 2 report: the NDA governs who may see them.
The exchange
How does a CUI package reach a supplier, and what is recorded?
When Sharetru sends the link, it opens for one supplier address; the supplier registers once with MFA, and every open is logged to an account. Below, a drawing goes out view-only with a watermark; the CAD model travels on its own link with download allowed.
How one drawing reaches one supplier
You send it. Sharetru checks it four times. The supplier opens it. The log writes itself.
Swipe the diagram to follow the drawing →
Sharetru sends it
One link per recipient, tied to their address
Each recipient gets their own link and signs in with the address it was sent to. A forwarded copy is refused at sign-in. Uses are counted per recipient.
You copy it
One link, for whoever you give it to
It is not tied to a recipient. Whoever opens it still signs in or registers as a guest, with MFA, so every open is logged to an account. Uses are pooled across the link; choose it only when you mean to.
Both kinds follow the expiry your administrator sets, by days and by uses; both appear on the Shares list; and both notify the link’s owner as they are used.
Revisions. Sharetru keeps no prior versions of a file. Keep revision history in your PLM or PDM system and send each revision as its own file (rev C, then rev D); the log shows which revision each supplier opened, and when a file was replaced or deleted, and by whom.
Your supplier’s side
What does a supplier have to do to open a file?
Register once with the address the link was sent to: a six-digit code, a name, a password and an authenticator app. After that they sign in with the same email and password on every link, see only what was shared, and never take a paid seat.
- InboxFrom Sharetru, for M. OkaforTo j.alvarez@castpartner.comM. Okafor shared a file with youHX220 drawing, rev C · link expires Nov 6Open1
The invitation
It names the sender and the files. Connect your mail server and it comes from your own domain.
- yourcompany.sharetru.comRegister to openj.alvarez@castpartner.com739104J. Alvarez••••••••••Register2
Register once
A six-digit code proves the address; then a name and a password, chosen once.
- yourcompany.sharetru.comSet up your authenticatorScan with any authenticator app, then enter the code it shows508261Verify3
Add MFA
On Sharetru Federal, every guest signs in with an authenticator app; email and SMS codes are off.
- yourcompany.sharetru.comShared with you by M. OkaforHX220-rev-C.pdfView onlyLink expires Nov 64
Open what was shared
Only the files on the link, for as long as it lasts. The drawing opens view-only with their address and the time across it; the STEP model came on a second link that allows the download.
- yourcompany.sharetru.comUpload to: HX220 inspection recordsDrop files here, or browseFAI-HX220-001.pdf uploadedLands in the folder M. Okafor chose5
Send files back
An upload-only link collects inspection records into the folder you chose. You are notified, and the upload is logged to their account.
When a supplier is stuck
Your administrator sees every link on the Shares list (who it went to, uses left, when it expires, when it was last used) and can extend it or raise its uses from the same row. An invitation nobody opens shows no uses and expires on schedule. A guest who becomes a long-term partner can be converted to a registered user, keeping the same account.
Send your first link on the certified environment, free for 15 days.Unlimited guests, never billed, from the first link.
Before the rule
What information are you exchanging?
The answer decides which rules apply: FAR 52.204-21 for FCI, and DFARS 252.204-7012 as well when it is covered defense information, a kind of CUI. Contract markings and the CUI Registry decide which you hold; a file’s extension does not.
- FCI
- FAR 52.204‑21 (opens in a new tab)Federal contract information:
information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government
, leaving out public and simple transactional information. The clause sets 15 basic safeguarding requirements. - CUI
- Executive Order 13556 · 32 CFR Part 2002 (opens in a new tab)Controlled Unclassified Information:
Unclassified information that requires safeguarding or dissemination controls pursuant to and consistent with law, Federal regulations, and Government-wide policies.
The CUI Registry lists its categories. - CTI
- CUI Registry · CUI//SP‑CTI (opens in a new tab)Controlled technical information, a Specified CUI category:
technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.
- CDI
- DFARS 252.204‑7012(a) (opens in a new tab)Covered defense information: controlled technical information
or other information, as described in the Controlled Unclassified Information (CUI) Registry
, that is marked or otherwise identified in your DoD contract and provided to you in support of it, or that you collect, develop, receive, transmit, use or store in support of the contract. Holding it triggers the clause: NIST SP 800-171, 72-hour incident reporting, and FedRAMP Moderate, or its equivalent, for the cloud service.
.pdf.step.dwg.xlsxAn extension tells you a file’s format, not its category. The same drawing can be CTI, FCI or neither, depending on the contract and its markings. Sharetru Federal blocks no file type and puts no size limit on a share; the contract and its markings decide what goes there.
Why FedRAMP Moderate
Why must the file-sharing service be FedRAMP Moderate, and what does that do for your assessment?
Under DFARS 252.204-7012, a cloud service holding CDI must meet the FedRAMP Moderate baseline or its equivalent, and CMMC Level 2 adopts that rule. Your SSP documents the certified service with its responsibility matrix; your assessor verifies the certification and reads the matrix instead of re-testing the service.
- 1
CDI in a cloud service triggers a contract clause.
DFARS 252.204-7012 says a cloud service holding covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline, and the clause flows down, without alteration, to every subcontract that involves CDI.
- 2
CMMC Level 2 points at the same clause.
32 CFR 170.19 says a cloud provider holding CUI
shall meet the FedRAMP requirements in 48 CFR 252.204-7012.
Level 2 adopted that bar; it did not raise it. - 3
A certified service is not re-tested.
You document Sharetru Federal in your SSP with the listing’s service description and a matrix covering all of NIST SP 800-171; your assessor verifies the certification and reads the matrix. That is the “FedRAMP reciprocity” people mean: the 3PAO’s work is relied on, not repeated.
- 4
Your part stays yours.
The matrix lists the objectives that are yours (people, policies, workstations, every other route CUI takes) and the ones you share. Configuration counts too: the controls work as your administrators set them.
…the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline…
Read the chain clause by clauseFor whoever writes the SSP: six requirements, what each asks, what Sharetru Federal provides, sources linked
| Requirement | What it asks | What Sharetru Federal provides | Source |
|---|---|---|---|
| 32 CFR 170.19(c)(2), Table 4CMMC Level 2 scoping: external service providers | A cloud service provider that processes, stores or transmits CUI “shall meet the FedRAMP requirements in 48 CFR 252.204-7012.” The relationship is documented in your SSP, the provider’s service description and a customer responsibility matrix. | The certified SaaS in a FedRAMP Moderate package that covers IaaS, PaaS and SaaS, and the responsibility matrix, written at the assessment-objective level. | 32 CFR 170.19 (opens in a new tab)govinfo.gov |
| DFARS 252.204‑7012(b)(2)(ii)(D)Safeguarding covered defense information (May 2024) | A cloud service used for covered defense information meets requirements equivalent to the FedRAMP Moderate baseline, and complies with paragraphs (c) to (g): incident reporting, malicious software, media preservation, forensic access and damage assessment. | Certified against the full FedRAMP Moderate baseline. Paragraphs (c) to (g) are contract terms, not baseline controls. | DFARS 252.204‑7012 (opens in a new tab)acquisition.gov |
| NIST SP 800‑171 Rev 2, via DFARS 7012(b)(2)(i)Assessed with NIST SP 800‑171A | Systems that hold CDI implement the 110 requirements of NIST SP 800-171; the CMMC rule assesses them through the 320 objectives of NIST SP 800-171A. Rev 2 remains the baseline today. | A matrix that assigns every one of the 320 objectives to Sharetru, to you, or to both, with an implementation statement for each. The assessment is the 3PAO’s; the crosswalk to 800-171A is Sharetru’s. | NIST SP 800‑171A (opens in a new tab)csrc.nist.gov |
| DFARS 252.204‑7019 and 7020NIST SP 800‑171 DoD assessment; SPRS | A current NIST SP 800-171 assessment score posted in SPRS before award, and access for Medium or High government assessments. | The basis to score accurately: the matrix says which objectives it assigns to the certified service. The score and the affirmation stay yours. | DFARS 252.204‑7020 (opens in a new tab)acquisition.gov |
| DFARS 252.204‑7021CMMC requirements (Nov 2025) | Hold the CMMC status the contracting officer specifies, affirm it annually in SPRS, and flow the requirement down to subcontractors. | The same evidence for a self-assessment or a C3PAO assessment: the listing, the matrix and the log. As of October 7, 2026, Phase 1 is in force and the Level 2 (C3PAO) requirement is suspended pending a program review. | DFARS 252.204‑7021 (opens in a new tab)acquisition.gov |
| 32 CFR 170.21Plans of action (POA&M) at Level 2 | A conditional Level 2 status needs at least 88 of 110 points. Requirements worth more than one point cannot sit on a POA&M, except FIPS-validated encryption when encryption is in place but not validated; gaps close within 180 days. | FIPS 140-3 validated cryptographic modules, AES-256 at rest and TLS 1.3 in transit, so encryption of CUI in the service is validated from the start. | 32 CFR 170.21 (opens in a new tab)govinfo.gov |
One thing the table does not say is that Sharetru makes you compliant. It does not: it covers the objectives the matrix assigns to Sharetru, for CUI exchanged through Sharetru Federal, configured as you set it.
The evidence pack
What will your assessor and your prime see, and how do you get it?
Four things: the FedRAMP listing, the responsibility matrix, the SOC 2 Type II report and your site’s access log. The listing is public. The matrix and the SOC 2 report come with a trial, under the NDA in the Terms of Service; the log is yours to export.
- PUBLIC
FedRAMP Marketplace listing
The package that names Sharetru Federal under certified services, maintained by FedRAMP.
PublicOpen it - 320 / 320
Responsibility matrix
NIST SP 800‑171 Rev 2: all 110 requirements and 320 objectives, each marked Sharetru, Shared or Yours.
In a trial · NDA - TYPE II
SOC 2 Type II report
The controls an independent auditor tested over the report’s period, with the auditor’s opinion.
In a trial · NDA - CSV
Your access log
Every view, upload, download and permission change in your site, logged to an account, kept 12 months on Sharetru Federal.
Yours, any time
In a trial
- Start the 15‑day trialon the certified environment
- Accept the Terms of Servicethey carry a mutual NDA
- Ask for the matrix and the SOC 2 reportduring the trial
Before anyone opens an account
- Open the FedRAMP listingpublic, no account needed
- Read the matrix by familyon this page
- Request a demofor your review team
Sharing them with your prime or your assessor? Ask us first: the NDA governs who may see them.
Swipe sideways to see the whole row →
yourcompany.sharetru.com · file log · illustrative export
A record of every action (view, upload, download, permission change), not of every file: Sharetru keeps no prior versions, and the log shows when a file was replaced or deleted, and by whom. Export it to CSV, forward it by syslog to your SIEM, or query the latest 90 days over the API.
Replacing a server
Can Sharetru Federal take over the transfers an existing server runs?
Yes, if your scheduler keeps the schedule: scripts, cron jobs and partner servers connect over SFTP, FTPS, SCP or the REST API. Sharetru has no job engine of its own, and PGP happens on your side, with your keys, before upload. What moves is the endpoint: the server address, accounts, keys and folders.
Swipe to see before and after →
- 1
Inventory the jobs.
List every script, schedule, service account and partner that touches the old server, and the folders each one uses.
- 2
Recreate accounts and keys.
One service account per job with its SSH key, limited to one IP range and one protocol (on Complete), and folder permissions that let a drop account write without browsing.
- 3
Run both, then repoint.
Point each script at your Sharetru address and run alongside the old server until the logs agree.
- 4
Move partners, retire the server.
Partners point their SFTP or FTPS client at the new address and sign in with their new credentials. Any still on plain FTP move to SFTP or FTPS, because Sharetru Federal runs encrypted services only.
What stays with you, by design
- The schedule. Sharetru has no job engine: cron, Task Scheduler, Azure Data Factory or your own code triggers every transfer.
- File-level PGP. Encrypt on your side, with your keys, before upload; Sharetru encrypts in transit and at rest with FIPS 140-3 modules, so Sharetru never has access to your file-level encryption keys.
- API notifications. Transfers over SFTP, FTPS and the web app send notifications; REST API actions do not, so check those in the log.
- Workflow logic. Routing, retries and transformations stay in your scripts.
nightly-push.sh · runs from cron on your job server
# Key-based SFTP push: no password stored
sftp -i ~/.ssh/sharetru_ecdsa -b - \
svc-quality@yourcompany.sharetru.com <<EOF
put /exports/FAI-$(date +%F).pdf /Out/castpartner/
EOFStandard OpenSSH with an RSA or ECDSA key: swap in your site’s hostname and the folder the service account is scoped to. The same job runs from WinSCP’s scripting mode or a PowerShell scheduled task.
Works with what you run
Will Sharetru Federal work with what we already own?
Yes for staff sign-in, supplier access, security logs and system transfers, with every connection marked native, API-based or built by you. Microsoft-centric and other environments sit side by side.
| What connects | Microsoft 365, GCC and GCC High | Other environments |
|---|---|---|
Staff sign-inYour employees |
NativeEntra ID single sign-onOnly members of a security group you choose can sign in, and each is also a Sharetru account: your directory decides who signs in, Sharetru decides what they reach. | NativeOkta, Auth0, OneLogin, PingOneSAML 2.0 or OAuth; the sign-in method is chosen per user. NativeSharetru sign-inA password and an authenticator app, for teams without an identity provider. |
Supplier accessGuests and partners |
NativeNo seat in your tenantPartners keep Sharetru-native credentials, so no external identity enters your directory and nothing changes inside the tenant. | NativeAny supplier with an email addressGuests register once with MFA; unlimited, and never billed. |
Security logsYour SOC and SIEM |
NativeMicrosoft SentinelThe audit trail forwarded through a data collection endpoint, with no middleware. | NativeSplunk, QRadar, ArcSight, Sumo Logic and other SIEMsAny syslog target, LogRhythm, Rapid7, CrowdStrike and Wazuh included. APILog APIFile and admin logs for the latest 90 days, for your own tooling. |
Application and script transfersJobs and systems |
APIAzure Storage, push and pullThrough the HTTPS File Transfer API; not a native connector. Your buildAzure Data FactoryIts SFTP connector, pointed at your site. | Your buildcron, OpenSSH, WinSCP, PowerShell, CI runnersStandard SFTP, FTPS and SCP, with nothing to install. APIYour applicationsThe REST API, documented at developer.sharetru.com. |
Notification mailInvitations and alerts |
NativeMicrosoft 365 SMTP with OAuthNotifications come from your own mail domain. | NativeAny SMTP serverThe same: your domain, not Sharetru’s. |
Plans and pricing
What does Sharetru Federal cost, and what do you commit to?
A Sharetru plan, the Sharetru Federal package and your storage, on a 12-month commitment; guests, every protocol and the API cost nothing extra. For a total you can defend, ask for a quote with your users and storage.
Your plan
Core or Complete
Core: 10, 20 or 30 users, with 10, 20 or 30 GB.
Complete: unlimited users, from 100 GB.
Log retention: 3 months on Core, 6 on Complete
Sharetru Federal package
The certified environment
FedRAMP Moderate Certified, FIPS 140-3 modules, 12 months of logs, watermarking and failed-login policies.
$200 a month on the plan page today
Storage
Fixed increments
Add storage as you grow, in the steps the plan page lists.
Your quote
One annual figure
A 12-month commitment; annual billing saves 10% on the plan page.
Get a quoteOnboarding: you set up your own site (users, folders, the domain list, sign-in methods), and a session with us walks the setup and the matrix with you. Support terms come with your quote, and the knowledge base is open at support.sharetru.com.
Does CUI have to go on Sharetru Federal?
Yes: CUI needs a cloud service that meets the FedRAMP Moderate baseline or its equivalent, and of the two platforms only Sharetru Federal is certified. Both share the same roles, link controls, log types and protocols, except plain FTP, which only Commercial offers. The table shows what Federal adds.
| What differs | Sharetru Commercial | Sharetru Federal |
|---|---|---|
| FedRAMP Moderate | —Not certified | Certified |
| Responsibility matrix | —Not included | Included |
| FIPS 140‑3 validated modules | —Not included | Included |
| MFA on password sign-ins | Optional | Required |
| Watermarking | —Not included | Per link |
| Log retention | 3 or 6 months | 12 months |
For MSPs and compliance consultantsBy invitation
Your clients need file sharing that meets FedRAMP Moderate. Partner with us to deliver it.
A selective resale and referral program for the firms defense contractors already rely on for their IT and compliance.
- Resale or referral
- Protected opportunities
- Recurring revenue on resale
We reply within 2 business days.
FAQ
Questions buyers ask before they put CUI in a cloud service
Does using Sharetru Federal make us CMMC compliant?
No: Sharetru Federal covers the objectives the matrix assigns to Sharetru, for CUI exchanged through the service; the rest of your SSP stays yours. It answers the cloud-provider question, with a public certification and a matrix written at the level your assessor examines.
Do we need a C3PAO assessment, or a self-assessment?
Your contract decides: DFARS 252.204-7021 names the level the contracting officer requires, and new requirements today are Level 1 and Level 2 self-assessments. The Level 2 (C3PAO) requirement was suspended on July 13, 2026, pending a program review, and had not resumed as of October 7, 2026. The cloud-provider requirement comes from DFARS 252.204-7012, which the July 13 suspension did not change: a cloud service holding CDI must meet the FedRAMP Moderate baseline or its equivalent, whichever assessment your contract calls for.
Is “FedRAMP Moderate equivalent” the same as FedRAMP Moderate Certified?
No, though DFARS 252.204-7012 accepts both: equivalency means a 3PAO-assessed package the provider hands you; certification means FedRAMP itself maintains the listing. Sharetru Federal is certified, so the proof is public and government-maintained rather than a body of evidence you keep on a vendor’s behalf.
The SaaS is Sharetru’s, but the Marketplace lists MIS Sciences Corporation. Why?
Because the certification belongs to MIS Sciences Corporation’s GovPoint Cloud Services, the boundary in which Sharetru Federal runs as the certified SaaS. Open package F1311222650 and the listing names Sharetru Federal under certified services. You contract with Sharetru either way.
Will Sharetru give us its FedRAMP security package?
No: the security package for GovPoint belongs to MIS Sciences Corporation, and FedRAMP releases it to federal agencies through the package access request. Sharetru will provide a 3PAO audit letter stating we have been audited against the full FedRAMP Moderate set of controls.Along with this, you get the public listing, the responsibility matrix and the SOC 2 Type II report, under the NDA in the Terms of Service. If your C3PAO, or DCMA’s DIBCAC, has questions about Sharetru Federal, we talk to your assessment team directly.
What is in the responsibility matrix, and how do we get it?
Every NIST SP 800-171 Rev 2 requirement and all 320 assessment objectives, each marked Sharetru, Shared or Yours, with an implementation statement for each. Ask for it during the 15-day trial, under the mutual NDA in the Terms of Service. Before a trial, the family view on this page and a demo show how it splits.
Does Sharetru Federal support PIV/CAC or hardware keys?
No: PIV/CAC, FIDO2 and hardware keys are not supported. On Sharetru Federal, Sharetru’s own sign-in takes a password and an authenticator-app code. Staff can sign in through your identity provider instead, in which case the factors are your provider’s; guests and partners use Sharetru’s sign-in.
Does Sharetru Federal keep earlier versions of a file?
No: Sharetru keeps no prior versions, so keep revision history in your PLM or PDM system and send each revision as its own file. The log records every view, upload, download and permission change, including when a file was replaced or deleted, and by whom.
Can Sharetru Federal hold ITAR technical data?
Yes: Sharetru Federal is administered only by U.S. persons as ITAR defines them, and its data stays in U.S. data centers. ITAR-regulated firms ask a cloud service for these two things beyond FedRAMP Moderate: no foreign-person access, and U.S. storage. Licenses, and who you share with, stay your decisions. See the ITAR page.
Does a cloud file-sharing service have to be FedRAMP Moderate for CMMC Level 2?
Yes, or an equivalent: under 32 CFR 170.19, a cloud service holding CUI shall meet the FedRAMP requirements in 48 CFR 252.204-7012.
Those call for security equivalent to the FedRAMP Moderate baseline. You document the service in your SSP with its service description and customer responsibility matrix; Sharetru Federal is certified, and its matrix assigns every objective.
What about FCI and CMMC Level 1?
Level 1 covers federal contract information with the 15 basic safeguarding requirements of FAR 52.204-21, and carries no FedRAMP requirement for the cloud services involved. If CUI may ever cross the service, start on Sharetru Federal, so partners, links and logs never have to move mid-contract.
Next step
Book the security and compliance review, or start a trial
Pick the step that fits where you are. The review answers your assessor’s questions in writing; the trial runs on the certified environment, and the matrix and the SOC 2 report come with it.
Rather see a CUI exchange first? Book a 60-minute demo. Need a quote? Ask for one in writing. Still reading? The full CUI and compliance FAQ. Not a compliance project? Talk through how you move files today.
Sources. Regulatory facts from FAR 52.204-21, the CUI program (Executive Order 13556, 32 CFR Part 2002 and the CUI Registry), DFARS 252.204-7012 and 252.204-7021, 32 CFR Part 170 and the DoD CIO CMMC page, FedRAMP’s February 25, 2026 designation notice and Marketplace listing F1311222650. Product facts from Sharetru product documentation and the plan page. Screens, names and files on this page are illustrative.