Move CUI through a certified service. Verify it on the government's record.

Is Sharetru Federal FedRAMP Moderate Authorized, Certified, or only "equivalent"?

Certified: Sharetru Federal is FedRAMP Rev 5 (Class C) Certified. That's FedRAMP's 2026 name for FedRAMP Moderate: the same package, the same NIST SP 800-53 Rev 5 Moderate baseline, the same Marketplace listing. FedRAMP switched its label from "Authorized", the older name in the question, on 25 February 2026, and the Consolidated Rules for 2026 (CR26) made the change official on 4 July 2026. The DFARS clause and the CMMC rule still say "FedRAMP Moderate"; a FedRAMP Rev 5 (Class C) Certified service satisfies that baseline.

"Equivalent" is different. DFARS 252.204-7012 requires any cloud service that handles covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. A service with no FedRAMP listing of its own has to demonstrate that equivalency; Sharetru Federal has a listing, so your SSP cites the package rather than an equivalency case.

Is this a Rev5 certification or a FedRAMP 20x one, and does it matter for DoD work?

Rev5. The listing's certification type is Rev5: the FedRAMP Moderate baseline, built on NIST SP 800-53 Rev 5, which is the baseline DFARS 252.204-7012 and 32 CFR 170 name. FedRAMP 20x is a separate certification path with its own rules; Sharetru Federal is not on it, and nothing on this page depends on it.

FedRAMP's Consolidated Rules for 2026 apply to Rev5 packages too; the package holder adopts them on its own schedule and the listing shows the result. The listing card above is the place to check the type; the listing itself governs.

Whose FedRAMP package is it, and what does that mean for us?

The certification belongs to MIS Sciences Corporation's GovPoint Cloud Services, the boundary in which Sharetru Federal runs as the certified SaaS. Open package F1311222650 and the listing names Sharetru Federal under Certified Services. You contract with Sharetru, not with MIS Sciences Corporation.

For your SSP, cite the package ID and the listing, and attach Sharetru's responsibility matrix: the assessment is the 3PAO's, the mapping to NIST SP 800-171 is ours.

Does the certification cover the application, or only the cloud it runs on?

All three layers. IaaS, PaaS and SaaS sit inside one boundary, and Sharetru Federal is the SaaS. The controls your CUI touches in the application (sign-in and MFA, access control, links, encryption at rest and in transit, logging) are inside the assessed boundary, not self-attested on top of someone else's cloud. The figure below shows the line.

What should we ask any vendor that says it runs on FedRAMP infrastructure?

One question: is your application inside a listed FedRAMP boundary, or only the cloud underneath it? A listing names the service. Hosting on a certified cloud puts the compute, storage and network in scope; it does not put the vendor's own software, access logic, encryption or logging in front of a 3PAO.

The answer decides what you write in your SSP and what your assessor can rely on. For Sharetru Federal, the listing's Certified Services section is the answer.

Is Sharetru's software assessed by a 3PAO, or only the infrastructure?

Both. First Information Technology Services (FITS), an accredited FedRAMP 3PAO, assesses the Sharetru Federal portion of the GovPoint package every year. Its August 2026 assessment examined the technical implementation of the 233 controls Sharetru is directly responsible for, with penetration testing and red-team exercises.

The remaining controls in the Moderate baseline belong to MIS GovPoint or are shared between us, and every control in the baseline is accounted for in the package's Appendix J, the control implementation summary and customer responsibility matrix, which an agency reads through FedRAMP package access. Access control enforcement, encryption at rest and in transit, audit logging, session handling and configuration management are among the families examined, with continuous monitoring in between; none of it is attested by us.

What we can hand you from it: the listing, our NIST SP 800-171 responsibility matrix, and, in the review, FITS's letter of attestation (4 September 2026) and a conversation with your assessment team. The assessment report and Appendix J belong to the package; see the package question.

Can we get the FedRAMP security package (the SSP with its Appendix J, the SAR and the POA&M)?

Not from Sharetru. The Body of Evidence belongs to the package, and FedRAMP releases it to federal agencies through its package access request. The route to the package is FedRAMP's access process, not the provider.

For a prime's or an assessor's due diligence, the listing is the proof you can hold without an account. The responsibility matrix and the SOC 2 Type II report come with a trial, under the Terms of Service (section 7.9), and with a customer account; see what you can hand your assessor.

Which encryption does Sharetru Federal use?

AES-256 at rest, TLS 1.3 in transit, and FIPS 140-3 validated cryptographic modules, on Sharetru Federal. Sharetru Commercial is described on its own pages; the two platforms are stated separately because only Sharetru Federal is inside the FedRAMP boundary.

Transfers over SFTP, SCP, FTPS and FTPeS are encrypted in transit; plain FTP is not offered on Sharetru Federal.

Where is our data stored, and who at Sharetru can reach it?

In U.S. data centers inside the GovPoint boundary, administered only by U.S.-citizen staff. That holds for production and for disaster recovery, and it is what lets Sharetru Federal carry ITAR technical data as well as CUI. These are Sharetru's statements; the listing does not show them, and the review puts them in writing for your file.

Every view, upload, download and permission change by an account on your site lands in the record you export.

How do people sign in, and can a guest reach CUI without MFA?

On Sharetru Federal every password sign-in takes an authenticator-app code, guests included; there are no email or SMS codes. People who sign in through your identity provider (Entra ID or another SAML 2.0 provider) carry its factors.

Systems connect over SFTP or SCP with an SSH key and the account's own restrictions. Lockout, password expiry and inactivity presets start from the FedRAMP Moderate baseline, and an administrator can tighten them, not loosen them. The user access page lists the roles and the presets.

What record do we get, and how long is it kept?

Every view, upload, download, link and permission change is logged to a named account and kept 12 months on Sharetru Federal. Export it to CSV at any time, forward it by syslog to any SIEM (Microsoft Sentinel and Splunk among them), and keep it as long as your policy says.

With the Federal package the record is kept 12 months whether the plan underneath is Core or Complete; Sharetru Commercial's retention is on the plan page. Sharetru does not keep prior versions of a file, so the record is a complete history of actions, not of file contents.

Once a guest opens a file, can CUI leave the boundary?

Only the way you set it: a link can be view-only, and Sharetru Federal can add an optional dynamic watermark to views through a link. You build the watermark from merge fields, such as the viewer’s address and the time, plus your own text. Download is allowed only where you allow it.

A site-level allow-list or block-list of domains decides who can be sent a link at all, and links Sharetru sends are tied to the recipient's address and refuse a forwarded copy.

What the record then shows is who viewed or downloaded what, from which account. What Sharetru does not do is inspect or classify the file: deciding what is CUI stays yours.

Can we use Sharetru Federal for ITAR technical data and export-controlled drawings?

Yes, with your own ITAR program on top of it. Sharetru Federal gives you U.S. data centers, U.S.-citizen administration, country-based access control with the United States always allowed, and the record of who opened what.

Links Sharetru sends are tied to the recipient's address: a forwarded copy is refused, and a copied link, which is not bound, still makes every opener register and sign in. Every password sign-in takes MFA, guests included.

What stays yours: deciding who qualifies as a U.S. person under ITAR, screening recipients, classifying the data and licensing any foreign party. The ITAR page walks through a drawing going out and the record it leaves.

Where does Sharetru sit beside SharePoint, OneDrive or GCC High?

Alongside them. Your enclave stays the system of record; Sharetru Federal is the exchange point for files that cross your boundary to primes, suppliers, labs and agencies. Partners never need a seat in your tenant, and the exchange leaves one record in one place.

What stays in your tenant: your internal documents, your identity provider, your Teams and email. What moves to Sharetru Federal: the partner's sign-in, the files that cross your boundary, the SFTP feeds your systems run, the record of each exchange, and one external-service entry in your SSP.

How does Sharetru Federal meet DFARS 252.204-7012 on safeguarding CUI and reporting incidents?

By certification, for the baseline half of what the clause asks. Paragraph (b)(2)(ii)(D) makes you require and ensure two things of any cloud service that handles covered defense information: security requirements equivalent to the FedRAMP Moderate baseline, and compliance with paragraphs (c) to (g) on cyber incident reporting, malicious software, media preservation, forensic access and damage assessment.

Sharetru Federal meets the first by certification: it is a listed Certified Service, which is how a FedRAMP Rev 5 (Class C) Certified service satisfies the Moderate baseline. For the second, the incident response, media protection and system-integrity controls behind (c) to (g) are inside the 3PAO's assessed scope.

The clause keeps its number and its NIST SP 800-171 Rev 2 baseline under Class Deviation 2026-O0025 (DFARS Part 240; the clause-number question below explains it), and it flows down to subcontractors that handle CUI. For the file side of an incident, the record shows every access, upload, download and share, exportable to your SIEM.

Does Sharetru Federal raise our SPRS score?

Not by itself. Your SPRS score is the NIST SP 800-171 self-assessment you post to the Government's Supplier Performance Risk System, and a requirement scores as met only when it is met across your whole system. What Sharetru Federal changes is the evidence behind the requirements that touch the files you exchange.

The matrix marks each of the 320 assessment objectives Sharetru-provided, shared or yours; the first two become inherited and partially inherited lines in your SSP, with the listing and the 3PAO's letter as the evidence that the provider is assessed. An SFTP server or file share you run yourself gives you nothing to inherit: every objective there is yours.

The score is a representation to the Government. DCMA can assess it under DFARS 252.204-7020 or, in contracts under the Part 240 class deviation, 252.240-7997; its result is posted in SPRS and takes precedence over your self-assessment. See the next question.

Where does Sharetru Federal fit if DCMA's DIBCAC assesses us?

As one external cloud service in your SSP, with evidence an assessor can examine rather than take on trust. DIBCAC, DCMA's assessment center, runs the Medium and High assessments: Medium is a document review and a conversation; High also verifies and demonstrates what the SSP says is implemented (DFARS 252.240-7997).

For the Sharetru Federal part of your system the set is: the SSP entry naming the service and package F1311222650; the 3PAO's letter; the responsibility matrix with your inherited and shared objectives marked; your site's settings for MFA, roles, links and country access, shown live or as dated screenshots; and the exported record for the period.

A DCMA result is posted in SPRS and takes precedence over any other assessment, with 14 business days to rebut with evidence, so collect this set before the assessment, not during it. Request the review and we prepare it with you and answer the assessment team directly and in writing.

Our new solicitation cites DFARS Part 240 and 252.240-7997, not 7019 and 7020. Is that the same requirement?

Partly. Under Class Deviation 2026-O0025, which rewrote the DFARS information-security clauses into a new Part 240 in 2026, 252.240-7997 carries the Government assessment terms, and 252.204-7012 keeps its number. Those terms: Medium and High assessments using NIST SP 800-171A, scores posted in SPRS, DCMA precedence, 14 business days to rebut, flow-down to subcontractors.

The Basic self-assessment that 252.204-7019 required is not in 7997's text; read your solicitation's Part 240 provisions for it. Whichever clauses your contract carries, the evidence Sharetru Federal gives you is the same.

CMMC Phase 2 is suspended. Does that change what we need from a file service?

No. The FedRAMP Moderate requirement comes from DFARS 252.204-7012, which the suspension left in force, and the CUI you hold is still CUI. What was suspended is the third-party certification gate; what was not is the safeguarding, the reporting, the SPRS score and the Government's right to assess.

The dates: on 13 July 2026 the Department of War (DoD) suspended the Phase 2 transition that would have made C3PAO certification (CMMC's assessors, distinct from the FedRAMP 3PAO) a condition of award from 10 November 2026, put Phases 3 and 4 on hold, and opened a review of the program. Class Deviation 2026-O0025 (DFARS Part 240) carries the suspension: Revision 2 put the instructions in, and Revision 3 (3 September 2026) keeps them and directs contracting officers to remove or revise third-party assessment requirements in new and existing solicitations and contracts. No replacement date had been announced, and the review's report, due 11 September, had not been published as of 11 October 2026.

What stays: NIST SP 800-171 Rev 2 under 7012, your SPRS score and affirmation, Level 1 and Level 2 self-assessments where a contract names them, and DoD assessments. Primes keep asking the same questions of their suppliers. The CMMC page keeps the dated status of the program; the sources are listed at the end of this page.

Our contract still carries DFARS 252.204-7021. What does Sharetru Federal do for it?

It gives the CUI you exchange under that contract a certified, documented home. The clause asks for the CMMC level the contracting officer names, affirmed in SPRS and flowed down to subcontractors.

New solicitations name Level 1 or Level 2 self-assessment while the suspension holds; a contract that already names Level 2 (C3PAO) says so until it is modified, and contracting officers have been directed to remove or revise those terms at the next modification. Confirm what yours intends before you budget for a C3PAO. The package ID, the 3PAO's letter, the matrix and the exported record go into your evidence either way.

Does using a FedRAMP Certified service make us NIST SP 800-171 or CMMC Level 2 compliant?

No. It makes the file service an external cloud service your assessment can account for. 32 CFR 170.19, still in force, says a cloud service provider that handles CUI must meet the FedRAMP requirements in DFARS 252.204-7012, and that you document the service in your SSP with the provider's responsibility matrix.

Sharetru Federal meets the baseline by certification and supplies the matrix. The objectives the matrix marks yours stay yours: your devices, your network, your people and your policies. The CMMC page covers what the rule asks of a cloud service and how Sharetru Federal fits a Level 2 assessment, self or C3PAO.

We are a Tier 2 or Tier 3 subcontractor. What do we tell our prime?

Tell them the service is certified and listed, give them the package ID to check, and expect three follow-ups. They will open the listing, ask whether you are on Sharetru Federal rather than Sharetru Commercial, and ask how responsibilities split; the matrix answers the last one.

Primes ask because their own 7012 obligations flow down to you, and many still flow CMMC terms down by contract. Answer from your own SSP and site settings, and attach the listing, the matrix and, once you have it, the 3PAO's letter; the Terms of Service let you give your prime the matrix for its supplier assessment of you, under your NDA with the prime, with our confidentiality terms flowed down in writing.

Which rules apply to the files we exchange: FCI, CUI, ITAR or EAR data, or more than one?

The file decides, not the sender: one drawing can be CUI and ITAR technical data at once, and then both sets of rules apply.

FCI, information provided by or generated for the Government under a contract and not intended for public release, carries the basic safeguarding requirements of FAR 52.204-21, and CMMC Level 1 where the contract names it.

CUI, marked by the agency or flowed down by your prime, carries DFARS 252.204-7012 and NIST SP 800-171 Rev 2, CMMC Level 2 where the contract names it, and, for a cloud service, security equivalent to the FedRAMP Moderate baseline.

ITAR technical data (22 CFR 120.33) and EAR technology (15 CFR 772.1) carry export rules on who can reach them, wherever they are stored: a foreign person's access counts as an export. Export-controlled information created or held for the Government is also CUI, in the CUI Registry's Export Controlled category.

Classifying each file stays with you: your contract, your markings, your export classification. If any of it is CUI, ITAR or EAR data, the answer on Sharetru is Sharetru Federal; the next question covers keeping it apart from FCI-only work.

We hold FCI and CUI across several contracts. How do we scope Sharetru correctly?

Separate the work by site, group and folder, per contract or program, and keep CUI where the stricter controls are. A site is a workspace with its own members.

FCI-only work can live in its own site or group; CUI goes through a Sharetru Federal site, where the Federal baseline's presets, country access controls and recipient-bound links (the ones Sharetru sends) apply.

The record then shows which contract relied on which structure, which is what a DCMA assessor, a C3PAO or a prime asks to see when they trace the CUI boundary.

How does Sharetru Federal work with primes, subs, labs and suppliers on one program?

Segment by site, group and project; invite outside people as guests with only the access each needs; run one policy and one log across everyone. Guests are unlimited on every plan and never take a seat, so a supplier who sends one file a quarter is never billed as a registered user.

Each exchange is tied to a named account on both ends, which is the supply-chain story a prime, an agency or an auditor wants: who handled the CUI, when, and under which program.

Will Sharetru give us a NIST SP 800-171 responsibility matrix?

Yes, at the assessment-objective level: all 320 objectives, each marked Sharetru-provided, shared or yours, with an implementation statement for your SSP. Shared means the inheritable part is stated and you implement the rest. A matrix that stops at the control leaves an assessor guessing; the objective is what they validate.

It comes with a trial, under the Terms of Service (section 7.9), and with a customer account. Before an account, the totals above are what we publish: 192, 73 and 55 of the 320.

Does adding Sharetru Federal grow or shrink our assessment scope?

It adds one external cloud service to your SSP, documented with the matrix, and gives the CUI exchange a home outside email and shared drives. Under 32 CFR 170.19 a cloud service that handles CUI is documented in the SSP with the provider's responsibility matrix.

55 of the 320 objectives stay yours for the CUI in Sharetru Federal; every objective still applies to the rest of your system. What can leave your scope, once your procedures send CUI through the service and nowhere else, is the ad-hoc path: the inbox, the shared drive and the self-run SFTP box that each needed their own story. What you keep is everything outside the boundary: your devices, your network, your people and your policies.

We are an MSP administering several clients. How does that work?

Each client has its own site; an MSP Administrator role manages a site without being able to open its files. The role can assign other roles, so give it only to people you trust with that. Each site is administered and logged on its own.

Your staff appear in each client's record under their own named accounts, which is what the client's assessor expects to see.

What can we actually hand a DCMA assessor, a C3PAO, a prime or an agency?

Four things: the public listing, the responsibility matrix, the SOC 2 Type II report, and your own exported record. The listing is open to anyone. FITS's letter of attestation comes with the review.

The matrix and the SOC 2 report come with a trial, under the Terms of Service (section 7.9), and with a customer account. Those terms let you give both to your assessor and to a prime assessing you as a supplier, each under a written confidentiality agreement with you, and to no one else. The record you export yourself, on your schedule.

An agency that needs the package itself requests it from FedRAMP through package access. Sharetru does not distribute it.

Is Sharetru Commercial FedRAMP Rev 5 (Class C) Certified too?

No. Only Sharetru Federal is inside the FedRAMP boundary; Sharetru Commercial is described on its own pages. If a contract says FedRAMP Moderate, CUI or ITAR, the answer is Sharetru Federal, as an add-on to a Core or Complete plan.