Sharetru Federal · FedRAMP Moderate Certified (Class C)
Share CUI files on a FedRAMP Moderate Certified service. The baseline is already set. Verify the certification on fedramp.gov.
FedRAMP presets arrive at the Moderate baseline, validated by a FedRAMP assessor (3PAO). You set up users, groups and folder permissions. Built for defense and aerospace suppliers, their prime contractors, and the agencies they serve.
- VerifyPackage F1311222650 on fedramp.gov names Sharetru Federal as a Certified Service
- ExchangeLinks for people, SFTP and FTPS for systems, the REST API for software
- HoldFIPS 140-3 validated modules, U.S. data centers, U.S.-citizen administrators
- ProveEvery view, upload, download, link and permission change, kept 12 months
The trial starts on the plan page: pick Core or Complete, add the Sharetru Federal package, check out · Checkout commits you to the 15-day free trial and nothing more: cancel during it and you owe nothing; otherwise it becomes your paid 12-month plan on the same site, with your setup intact
Reviewing for a prime or an agency? Check the listing, or bring the questionnaire to a 30-minute security and compliance review. Buying? What it costs.
The MFA, encryption and record presets implement FedRAMP controls FITS validated in August 2026: an administrator can only make them stricter. Country access is Sharetru’s own rule, and adding a country is yours. Illustrative panel.
When the checklist says FedRAMP Moderate
When CUI moves through a cloud service, the reviewer’s first question is: is it FedRAMP Moderate, and can you prove it?
Primes, assessors and agencies ask it in four different ways. Each one has an answer on this page, and the answer names its source.
Holding a questionnaire? Bring it to a 30-minute security and compliance review, and afterwards we answer its questions about Sharetru Federal in writing.
Request the review-
A prime’s questionnaire
Your prime asks for the package ID and whether the file service is certified or only “equivalent”
DFARS 252.204-7012 flows the question down to every subcontractor that handles covered defense information, and the reviewer opens the Marketplace before reading your answer.
Answered by The listing: package F1311222650 names Sharetru Federal under Certified Services, so your SSP cites a package, not an equivalency case.
-
An assessor’s evidence request
DCMA, a CMMC assessor (C3PAO) or an agency assessor asks who assessed the service and what they examined
A listing proves the status. An assessor also asks which layer was in scope, and whether the application itself was examined, not only the cloud under it.
Answered by The boundary: three layers in one package; FITS, the 3PAO, assesses Sharetru Federal’s own controls every year and GovPoint’s assessment covers the rest, so every control and objective in the Moderate baseline is assessed.
-
A server nobody can certify
CUI still moves over a self-run SFTP box or an email thread
Every objective on a server you run is yours to evidence, and an email thread scatters the record across mailboxes.
Answered by The Federal baseline: MFA, FIPS 140-3 modules and a 12-month record are presets a 3PAO validated, not projects.
-
An agency program office
An agency wants the package through FedRAMP, and your prime wants the matrix
Package access is FedRAMP’s process, for federal agencies. A prime wants the responsibility matrix; a trial user wants the SOC 2 report.
Answered by The evidence: what each reader can hold, where it comes from, and what Sharetru does not hand out.
Verify it yourself
Is Sharetru Federal FedRAMP Moderate Certified, and how do we check?
Yes: Sharetru Federal is FedRAMP Moderate Certified (Class C), the status FedRAMP called “Authorized” until February 25, 2026. Open package F1311222650 on fedramp.gov: Sharetru Federal is listed by name under Certified Services. Cite the listing rather than this page; your assessor can open the same record.
The package belongs to MIS Sciences Corporation’s GovPoint Cloud Services, the government community cloud Sharetru Federal runs in, so the listing opens under their names. The label is new, the certification is not: the package was authorized through FedRAMP’s Joint Authorization Board, which granted provisional authorizations itself, with no sponsoring agency needed, and the listing still records that path as “JAB”. FedRAMP has since retired the board in its modernization, and on February 25, 2026 it renamed the status: same package, same Rev5 baseline, newer words. The DFARS clause and the CMMC rule still say “FedRAMP Moderate”, and FedRAMP’s own listing pairs Class C with Moderate through 2026.
F1311222650- Cloud service providerMIS Sciences Corporation
- Cloud service offeringGovPoint Cloud Services
- StatusFedRAMP Certified
- PhaseOngoing Certification
- ClassClass C (Moderate)
- Type · PathRev5 · JAB
- Service modelIaaS, PaaS, SaaS
- Deployment modelGovernment Community Cloud
- Certified servicesSharetru Federal (one of twelve listed)
- Service descriptionSharetru Federal (SaaS): Managed File Transfer as a Service (MFTaaS) supporting CMMC, ITAR, HIPAA, and PCI-DSS regulated data exchange
One certification, three layers
One package, assessed against NIST SP 800-53 Rev 5 with continuous monitoring and an annual assessment. First Information Technology Services (FITS), a FedRAMP-recognized 3PAO (FedRAMP now says “assessor”), assesses the Sharetru Federal portion every year: in August 2026, the 233 controls Sharetru implements, with penetration testing and red-team exercises. The rest of the Moderate baseline is GovPoint’s, assessed in its own annual assessment, so every control and objective in the baseline is assessed across the stack. The status, phase and class on the listing are FedRAMP’s fields; the Certified Services list and the service description are the package holder’s submissions, which FedRAMP publishes with its own disclaimer. What shows that the Sharetru Federal portion was assessed is FITS’s letter of attestation, which Sharetru sends on request, with no NDA.
What Sharetru hands out, and what it does not
What comes from Sharetru, and what comes from FedRAMP
From Sharetru: FITS’s letter of attestation, on request, with no NDA; and, for customers, Appendix J of the package’s system security plan (the control implementation summary and customer responsibility workbook), under the NDA in section 7.9 of the Terms of Service. From FedRAMP only: the system security plan itself, the assessment report and the plan of action and milestones, which belong to GovPoint’s package and which FedRAMP releases to federal agencies through the package access request. Without an account you can hold the listing and the letter; the responsibility matrix and the SOC 2 Type II report come with a trial or a customer account, under the same NDA.
Inside the boundary
What happens to a CUI file on Sharetru Federal?
Every control the file passes runs inside the assessed boundary: sign-in, encryption, the link rule, the watermark and the record are Sharetru Federal’s. Scroll, and the file makes the trip; the control families behind these steps (access control, identification and authentication, system and communications protection, audit) are among those FITS examined in August 2026.
Swipe sideways to see it all →
- 1Sign-inAuthenticator-app code, guests included
- 2EncryptedFIPS 140-3 modules · AES-256 · TLS 1.3
- 3Recipient ruleDomain rule · United States
- 4Watermarked viewView-only; download only where you allow it
- 5RecordedNamed account · kept 12 months
Illustrative: names, files and times are invented. The sign-in, encryption and record presets implement FedRAMP controls, and an administrator can only make them stricter; the domain list, country access and per-link download are Sharetru’s own rules, and yours. What stays outside the boundary is yours: your devices, your network, your identity provider, your policies, and deciding what is CUI.
Assessed
Who examines the application
Every year, FITS, the FedRAMP 3PAO, assesses the 233 controls Sharetru implements, most recently in August 2026, with penetration testing and red-team exercises. GovPoint’s own annual assessment covers the rest, so every control and objective in the Moderate baseline is assessed.
Outside the boundary
What stays yours
Your devices and your network, your identity provider if you sign in with SSO, your policies, screening and training, and the decision about what is CUI. Sharetru Commercial sits outside the boundary too: it is not certified.
Alongside Microsoft
Where it sits beside GCC High
Your enclave stays the system of record. Sharetru Federal is the exchange point at its edge: partners never need a seat in your tenant, staff can sign in through your identity provider, and every exchange leaves one record you can forward to your SIEM by syslog.
The Federal baseline
What does the Federal baseline set, and what is left for us to configure?
Every Sharetru Federal site opens at the FedRAMP Moderate baseline: each preset with a control id below can only be made stricter. What you configure is people: users, groups, folder permissions, and who may receive links.
The rule exists because FITS, the FedRAMP 3PAO, examines the running configuration every year: each preset with a control id implements a control FITS validated in August 2026, and the configuration it validated is the one every site runs, or a stricter one. Country access, the recipient domain list and per-link download are Sharetru’s own rules rather than FedRAMP’s, and yours; people who sign in through your identity provider carry its factors, and those are yours too. For the CUI you keep in Sharetru Federal, Sharetru’s responsibility matrix assigns 192 of the 320 NIST SP 800-171 objectives to Sharetru Federal, 73 as shared and 55 to you, in your own environment; the matrix names every one.
What your partners see
What does a guest go through to open a CUI file?
Three steps a guest cannot skip on Sharetru Federal: register, sign in with an authenticator-app code, then open the file through the link you sent. A view-only link shows a watermarked view; download appears only where you allowed it; the view lands in your record.
- yourcompany.sharetru.comCreate your guest accountr.patel@prime-example.comRiya Patel••••••••••Continue1
Register once
A link Sharetru sends is tied to the recipient’s address, and a forwarded copy is refused. If someone copies the link instead of forwarding the email, the link is not tied to an address, but whoever opens it still has to register and sign in. Guests are held to the same Federal presets as your staff.
- yourcompany.sharetru.comEnter the code from your authenticator appNo codes by email or SMS on Sharetru FederalSign in2
Sign in with an app code
Every password sign-in on Sharetru Federal takes an authenticator-app code, guests included. People who sign in through your company’s single sign-on use its sign-in checks instead.
- yourcompany.sharetru.com · SharesShared by M. Okafor · view onlyDWG-2291.pdfView onlyWatermark: viewer’s address and time, on every view3
View with a watermark
Every view through a link on Sharetru Federal, in the browser viewer, carries a dynamic watermark with the viewer’s address and the time. Download is allowed only where you allow it, and the view lands in your record.
Illustrative screens
Names, files and times are invented. The behaviour is Sharetru Federal’s: registration before any link opens, an authenticator-app code on every password sign-in, a watermark on every view through a link.
The evidence
What can you hand a prime, an assessor or an agency, and how do you get it?
Four documents and your own exported record: the public listing, the responsibility matrix, the SOC 2 Type II report and FITS’s letter of attestation. The listing is open to anyone and the letter comes on request without an NDA; the matrix and the report come with a trial or an account under the NDA; the record is yours.
Customers also get Appendix J of the package’s system security plan, which shows which controls are GovPoint’s, Sharetru Federal’s, shared or yours, under the same NDA.
- PUBLIC
FedRAMP Marketplace listing
Package F1311222650 names Sharetru Federal under Certified Services; maintained by FedRAMP from the package holder’s submissions.
PublicOpen it - SP 800-171
Responsibility matrix
NIST SP 800-171 Rev 2: all 110 requirements and 320 objectives, each marked Sharetru, Shared or Yours, with an implementation statement.
In a trial · NDAStart the trial - TYPE II
SOC 2 Type II report
The controls an independent auditor tested over the report’s period, with the auditor’s opinion.
In a trial · NDAStart the trial - 3PAO
Letter of attestation
FITS, the FedRAMP 3PAO: the Sharetru Federal portion assessed August 2026, the 233 controls Sharetru implements, with penetration testing and red teaming; the rest of the baseline sits in GovPoint’s assessment.
On request · no NDARequest it
Verify it on fedramp.gov
- Searchthe FedRAMP Marketplace for Sharetru or GovPoint
- OpenMIS Sciences Corporation, GovPoint Cloud Services, package F1311222650
- Scroll to Certified ServicesSharetru Federal is listed by name
- Cite the packageand the listing in your SSP; attach the matrix
In a trial, or as a customer
- Start the 15-day trialfrom the plan page, with the Federal package added
- Accept the Terms of Servicethey carry the NDA (section 7.9)
- Ask for the matrix and the SOC 2 reportduring the trial
- Share themonly with the people section 7.9 names: your own employees and contractors, your assessors and advisers, and your prime
An agency that needs the package itself requests it from FedRAMP through package access; before any account, FITS’s letter, the 30-minute security and compliance review and a demo are open to everyone. Sharing the matrix, the SOC 2 report or Appendix J beyond those people needs our agreement first: section 7.9 of the Terms of Service governs who may see them, and under what written obligations.
Swipe sideways to see the whole row →
yourcompany.sharetru.com · activity record · illustrative export
The record logs every action: view, upload, download, link and permission change. It keeps no old versions of files; it shows when a file was replaced or deleted, and by whom. Export it to CSV, forward it by syslog to your SIEM, or query the latest 90 days over the API.
Which Sharetru
Which platform do you need, and what do the words on the listing mean?
Sharetru Federal for CUI and CDI, and for ITAR technical data; Sharetru Commercial for everything else. Both share the same roles, link controls and record types, and every protocol except plain FTP; only Sharetru Federal is inside the FedRAMP boundary. The terms below are the listing’s.
- CERT
- FedRAMP definitions, 2026 (opens in a new tab)FedRAMP Certified. The status of a cloud service offering that has received FedRAMP Certification, and FedRAMP’s current term for the status the FedRAMP Authorization Act describes. The name changed on February 25, 2026; the certification did not.
- CLASS C
- The listing (opens in a new tab)Class C (Moderate). FedRAMP’s 2026 classes run from A, minimal assurance, to D, significant assurance. Class C is the Moderate baseline. The listing shows “Class C (Moderate)” until December 31, 2026; from January 2027 the Marketplace drops the impact-level words and shows the class alone (the Marketplace’s own notice), and Class C still means the Moderate baseline.
- REV5
- The listing (opens in a new tab)Rev5. The certification type: the FedRAMP Moderate baseline built on NIST SP 800-53 Rev 5, the baseline DFARS 252.204-7012 and 32 CFR 170 name. FedRAMP 20x is a separate path; Sharetru Federal is not on it, and nothing on this page depends on it.
- PHASE
- The listing (opens in a new tab)Ongoing Certification. The listing’s phase after certification: steady-state continuous monitoring and reporting, in FedRAMP’s words. The other phases FedRAMP shows are Initial Implementation and Legacy FedRAMP Ready.
- SCOPE
- The listing (opens in a new tab)Certified Services. The applications and microservices the package holder lists as included within the offering’s assessment scope. Sharetru Federal is one of them. Hosting on a certified cloud, by itself, puts nothing of a vendor’s own software in that list.
- DEPLOY
- The listing (opens in a new tab)Government Community Cloud. The deployment model the listing shows for the package: a community cloud for government customers rather than the public cloud.
- EQUIV
- DFARS 252.204-7012 (opens in a new tab)Equivalent. The clause’s standard for any cloud service that handles covered defense information: security requirements equivalent to the FedRAMP Moderate baseline. A listed, certified service meets it by certification; an unlisted one has to demonstrate it. Sharetru Federal has a listing, so your SSP cites the package rather than an equivalency case.
.pdf.step.dwg.zipNo file-type restrictions on either platform, and Sharetru does not inspect or classify files: deciding what is CUI stays yours.
Plans and pricing
What does Sharetru Federal cost, and what do you commit to?
Your Sharetru plan + the Sharetru Federal package ($200 a month on the plan page today) + your storage, on a 12-month commitment.
Your plan
Core or Complete
Core: 10, 20 or 30 users, with 10, 20 or 30 GB.
Complete: unlimited users, from 100 GB.
Log retention without the Federal package: 3 months on Core, 6 on Complete
Sharetru Federal package
The certified environment
FedRAMP Moderate Certified (Class C), FIPS 140-3 modules, 12 months of logs, watermarking and the lockout presets.
$200 a month on the plan page today
Storage
Fixed increments
Add storage as you grow, in the steps the plan page lists.
Your quote
One annual figure
A 12-month commitment; annual billing saves 10% on the plan page.
Get a quoteStarting: the trial begins on the plan page, where you pick Core or Complete, add the Sharetru Federal package and check out. Checkout commits you to the 15-day free trial and nothing more: cancel during the trial and you owe nothing; otherwise, on day 16 the trial becomes your paid 12-month subscription on the same site, so nothing you set up during the trial is lost. Onboarding: you set up your own site (users, groups, folders, the domain list, your identity provider if you use one), and a session with us walks the setup and the matrix with you. Support terms come with your quote; the knowledge base is open at support.sharetru.com.
Which plan carries the Federal package?
Either: the Federal package is an add-on to Core or Complete. The plan decides users and storage; the package decides the environment, and only Sharetru Federal is inside the FedRAMP boundary. Both platforms share the same roles, link controls and log types, and every protocol except plain FTP. The table shows what Federal adds.
| What differs | Sharetru Commercial | Sharetru Federal |
|---|---|---|
| FedRAMP Moderate | —Not certified | Certified (Class C) |
| Responsibility matrix | —Not included | Included |
| FIPS 140-3 validated modules | —Not included | Included |
| MFA on password sign-ins | Optional | Required, app only |
| Watermarking | —Not included | Every guest view |
| Activity record | 3 or 6 months | 12 months |
| Plain FTP | Available | —Not offered |
For MSPs, RPOs and compliance consultants
Your clients need file sharing that meets FedRAMP Moderate. Partner with us to deliver it.
A referral program for the firms that advise defense suppliers, and an MSP Administrator role that manages a client’s site without opening its files. Because the role can assign other roles, give it only to people you trust with that.
- Referral program
- One MSP Administrator role per client site
- Each client site administered and logged on its own
FAQ
What reviewers ask about Sharetru Federal
The certification
Is the certification of Sharetru’s software or only of the cloud it runs on?
Both: the application and the cloud under it sit in one FedRAMP boundary, and FITS, the FedRAMP 3PAO, assesses the Sharetru Federal portion every year. Its August 2026 assessment covered the 233 controls Sharetru is directly responsible for, with penetration testing and red-team exercises; the rest of the Moderate baseline is GovPoint’s or shared, all accounted for in Appendix J.
GovPoint’s own annual assessment covers those remaining controls, so every control and every assessment objective in the FedRAMP Moderate baseline is assessed across the full stack: the application by FITS, the platform and infrastructure by GovPoint’s assessor.
Whose FedRAMP package is it, and what does that mean for our SSP?
The package belongs to MIS Sciences Corporation’s GovPoint Cloud Services, the boundary Sharetru Federal runs in as a certified SaaS; you contract with Sharetru. In your SSP, cite package F1311222650 and the listing, and attach Sharetru’s responsibility matrix: the assessment is the assessor’s, the mapping to NIST SP 800-171 is ours.
Can a federal agency use this package for its own authorization?
An agency requests GovPoint’s package from FedRAMP through package access, reviews it, and issues its own authorization to use; Sharetru does not distribute the package. What Sharetru gives an agency directly is the listing, FITS’s letter of attestation, the security and compliance review and written answers to its questions.
The responsibility matrix comes with a trial or an account, under the NDA in section 7.9 of the Terms of Service.
Is Sharetru Commercial FedRAMP certified too?
No: only Sharetru Federal is inside the FedRAMP boundary, so for FedRAMP Moderate, CUI or ITAR the answer is Sharetru Federal. It is an add-on to a Core or Complete plan. Sharetru Commercial is SOC 2 Type II Attested and described on its own pages.
The environment
Where is our data, and who administers it?
In U.S. data centers inside the GovPoint boundary, for production and disaster recovery, administered only by U.S.-citizen staff. These are Sharetru’s statements rather than fields on the listing; the security and compliance review puts them in writing for your file. Every view, upload, download, link and permission change by an account on your site lands in the record you export.
What does the Federal baseline change for our users and our partners?
Every password sign-in takes an authenticator-app code, guests included; lockout, password expiry and inactivity presets apply; guest views through links are watermarked. People who sign in through your identity provider carry its factors. Systems connect over SFTP or SCP with an SSH key and the account’s own restrictions. Guests register once and never take a paid seat.
Can we relax a Federal preset, or add a country?
No preset that implements a FedRAMP control can be relaxed; a country can be added, because country access is Sharetru’s own rule. The configuration FITS validated in August 2026 is the one every site runs, or a stricter one; per-link download and your domain list are yours too, and sign-ins through your identity provider carry its factors.
Can Sharetru Federal hold ITAR technical data?
Yes, with your own ITAR program on top: U.S. data centers, U.S.-citizen administration, country access, and the record of who opened what. Deciding who is a U.S. person under ITAR, screening recipients, classifying the data and licensing any foreign party stay yours.
Where does Sharetru Federal sit beside SharePoint, OneDrive or GCC High?
Alongside them: your enclave stays the system of record, and Sharetru Federal is the exchange point for files that cross your boundary. Partners never need a seat in your tenant, staff can sign in through your identity provider, and the exchange leaves one record in one place. What stays in your tenant: your documents, your identity provider, Teams and email.
Contracts and evidence
Does using a FedRAMP Certified service make us NIST SP 800-171 or CMMC Level 2 compliant?
No: it makes the file service an external cloud service your assessment can account for, documented in your SSP with Sharetru’s responsibility matrix. The objectives the matrix marks yours stay yours: your devices, your network, your people and your policies.
Can we get the SSP, the assessment report or the POA&M?
Not from Sharetru: the SSP, the assessment report and the POA&M belong to GovPoint’s package, and FedRAMP releases them to federal agencies. Customers get the SSP’s Appendix J, the control implementation summary and customer responsibility workbook, under the NDA in section 7.9 of the Terms of Service; FITS’s letter of attestation comes on request, with no NDA.
What do we set up ourselves, and how do we start?
Four steps: pick a plan and the Federal package on the plan page, name your site, create groups and folder permissions, invite users and guests. The FedRAMP presets are already at the baseline; connect your identity provider if you use SSO. A session with us walks the setup and the matrix; we publish no setup times we have not measured.
Next step
Book the security and compliance review, or start a trial on the certified environment.
Either way you see it working: a site of your own under the Federal baseline, or a 30-minute review on a live site with sample files, with written answers to your assessor’s questions about Sharetru Federal afterwards.
Rather see a CUI exchange first? Book a 60-minute demo on a live Sharetru Federal site. Need a quote? Ask for one in writing. Not a compliance project? Talk through how you move files today.
Sources: the FedRAMP Marketplace listing for package F1311222650 and FedRAMP’s 2026 definitions and designation notice, FITS’s letter of attestation (September 4, 2026), DFARS 252.204-7012, 32 CFR 170.19, NIST SP 800-53 Rev. 5, Sharetru’s NIST SP 800-171 responsibility matrix v2.3, the Sharetru Terms of Service, the plan page and the Knowledge Base. The Marketplace’s own notice: the former impact levels show in parentheses after the class until December 31, 2026, and from January 2027 the class stands alone; the listing governs, and we re-read it at every update and at least quarterly. Product screens are illustrative. Nothing on this page is legal advice or a statement about the outcome of your assessment.