FedRAMP Moderate equivalency

FedRAMP is the federal government's authorization program for cloud services. DFARS 252.204-7012 requires that a cloud service provider storing covered defense information for a contractor meet security requirements equivalent to the FedRAMP Moderate baseline. A DoD CIO memo dated December 21, 2023 spelled out what equivalent means: an assessment by a FedRAMP-recognized third-party assessment organization (3PAO), full evidence of every control, and no open POA&M items. A SOC 2 report does not qualify.

For a small shop, this is why putting CUI into an ordinary cloud ERP or file-sharing tool is a problem. The question isn't whether the vendor is secure in general; it's whether they can produce FedRAMP Moderate authorization or an equivalency package your assessor will accept.

A box you own on your own network isn't an external cloud service, so the requirement doesn't apply to it. That's the route Traveler's Shop Server ($4,250) and Shop Server Defense ($6,500) take. The box is still in your CUI scope and has to meet your 800-171 controls like any other system, and vendor remote access can make the vendor an external service provider.