Shop Server documentation
Shop Server Security & Customer Responsibility Matrix
The Shop Server keeps CUI and export-controlled technical data on a box you own, on your own network, instead of a third-party cloud. That puts it inside your CUI scope, so your System Security Plan has to account for it. This page lays out, for each of the 14 NIST SP 800-171 Rev 2 control families, what the box provides, what's shared, and what your shop is responsible for. Your shop owns its SSP and its controls; the box is designed to be the easiest part of that scope.
What the box provides, at a glance
- ✓Multi-factor sign-in on every account
- ✓Role-based access inside the app
- ✓Tamper-evident audit log of views, changes and exports
- ✓FIPS-validated cryptographic module for data at rest and in transit
- ✓TPM-bound full-disk encryption
- ✓Signed updates you approve, online or by USB
- ✓Remote support only in sessions you grant
- ✓Encrypted backups with keys you hold
Applies to both builds unless noted. Shop Server Defense adds a hardened FIPS-mode configuration, mirrored drives, a UPS, an encrypted USB backup drive, US-person-only support, and the full 800-171 control mapping with an SSP template excerpt. Shop Server uses the same software and security features in a standard configuration.
Customer responsibility matrix by NIST SP 800-171 family
| Family | What the Shop Server provides | Shared | What your shop is responsible for |
|---|---|---|---|
| Access Control (3.1) | Role-based access inside the app; per-user accounts (no shared logins); session timeout and lock; account lockout after failed sign-ins; a LAN-only mode with no inbound ports. | We supply the roles; you decide who gets which one and keep it least-privilege. | Authorizing users, access reviews and offboarding; Wi-Fi and remote-access policy; controlling CUI flow to other systems (email, USB, other software). |
| Awareness & Training (3.2) | Nothing on its own. We publish admin and user guides for the box. | Our documentation can feed your training material. | Security awareness and insider-threat training for everyone who handles CUI. |
| Audit & Accountability (3.3) | Tamper-evident audit log of sign-ins, views, changes, exports and admin actions, with user and timestamp; logs included in backups; optional forwarding to your syslog server. | The box records events; you choose retention and where copies go. | Reviewing logs, correlating them with your other systems, and acting on what they show. |
| Configuration Management (3.4) | Ships in a hardened baseline configuration with unused services off; signed updates you approve; a software bill of materials per release. | We maintain the box's baseline; you track it as an asset in your inventory and change process. | Your asset inventory, change control, and the configuration of the PCs, tablets and network that connect to the box. |
| Identification & Authentication (3.5) | Multi-factor sign-in required for every account (authenticator app or security key); passphrase rules; credentials stored hashed; device pairing for kiosks. | We enforce MFA in the app; you issue and recover users' factors. | Identity proofing of employees, MFA for your other systems, and handling lost devices. |
| Incident Response (3.6) | Audit log and backups that support investigation and recovery; the owner is alerted to missed backups and repeated failed sign-ins. | We notify you of security issues affecting the box and help with investigation during an approved session. | Your incident response plan, testing it, and reporting incidents to your customers or the DoD as your contracts require (for example, the 72-hour DFARS 7012 report). |
| Maintenance (3.7) | Remote support only through sessions you start and approve; time-limited, recorded in the audit log; no standing vendor access. | We perform maintenance only inside sessions you grant. On Shop Server Defense, by US persons only. | Approving and supervising sessions, and controlling any on-site maintenance or media leaving the building. |
| Media Protection (3.8) | TPM-bound full-disk encryption; encrypted backups with keys you hold, never us; Shop Server Defense includes an encrypted USB backup drive; secure wipe of returned units. | We encrypt the media; you control where it physically goes. | Storing, marking and transporting backup drives and printouts; sanitizing other media; your USB and removable-media policy. |
| Personnel Security (3.9) | Nothing on its own; disabling a user removes access immediately. | — | Screening people before granting CUI access, and removing access promptly when they leave or change roles. |
| Physical Protection (3.10) | Small, fanless box that fits in a locked cabinet; disk encryption protects data if the box is stolen. | — | Where the box and backup drives live, who can reach them, visitor control, and physical access logs. |
| Risk Assessment (3.11) | Published security documentation, SBOM per release, and security fixes in signed updates. | We disclose vulnerabilities affecting the box and ship fixes; you include the box in your assessments and scans. | Periodic risk assessments and vulnerability scanning of your environment. |
| Security Assessment (3.12) | This matrix, the spec sheet, and (Defense) an 800-171 control mapping and SSP template excerpt. | We answer your assessor's or consultant's questions about the box. | Your System Security Plan, POA&M, SPRS score, and periodic assessment of your controls. |
| System & Communications Protection (3.13) | Encryption in transit on your LAN and for any optional outbound connection; FIPS-validated cryptographic module for data at rest and in transit (hardened FIPS-mode configuration on Defense); no inbound ports; documented, limited outbound destinations; LAN-only mode. | We document every outbound connection; you decide which to allow at your firewall. | Network segmentation, firewall rules, boundary protection, and secure configuration of your other systems. |
| System & Information Integrity (3.14) | Signed updates verified before install with rollback; security fixes delivered while updates are active; integrity-checked audit log. | Updates are included for 12 months, then with the continuity plan; you choose when to install. | Malware protection and patching on your PCs and other systems, and monitoring for unusual activity. |
Remote support and External Service Providers
The box is customer-owned and on your premises, so it isn't an external cloud service provider, and FedRAMP Moderate equivalency for cloud-stored covered defense information doesn't apply to it.
Vendor remote access is different: it can make the vendor an External Service Provider in your scope. So there is no standing access. Traveler becomes an ESP only for the sessions you grant: you start each one from the box, approve it, and it ends when you close it, with the session recorded in your audit log. On Shop Server Defense, sessions are handled by US persons only. Shops that want no ESP at all can run with remote support off and get help by phone and email.
Supply chain and Section 889
We source hardware to comply with Section 889 of the FY2019 NDAA (no covered telecommunications or video surveillance equipment) and will provide a written attestation on request. We avoid no-name hardware whose origin and firmware supply chain can't be attested.
Each software release ships with a software bill of materials. The box ships to US addresses only; your shop remains responsible for its own ITAR and EAR obligations for the data you store on it.
Download the full matrix as a spreadsheet
The spreadsheet breaks this down control by control across all 110 NIST SP 800-171 Rev 2 requirements, each marked Shop Server, Shared or Customer with a note on what the box does and what your shop does, ready to reference from your SSP. It opens in Excel or Google Sheets; send it to your MSP or consultant too.
This page describes how the Shop Server supports your security program. It is not legal advice and doesn't certify anything: no product makes a shop CMMC certified or compliant with ITAR or any other regulation. Your shop is responsible for its own System Security Plan, controls and assessments. See also the setup guide and terms of sale.
Security questions
▸Does the Shop Server make my shop CMMC compliant?
No product does. Compliance belongs to your shop: your policies, people, facility and System Security Plan. The Shop Server keeps CUI and technical data off third-party clouds and supports the NIST SP 800-171 controls in this matrix. CMMC Phase 2 assessment requirements were suspended on July 13, 2026, but DFARS 252.204-7012, NIST SP 800-171 and SPRS scores still apply wherever they are in your contracts.
▸Is Traveler an External Service Provider for my shop?
Only when you grant a remote support session. The box is customer-owned and on your premises, so it isn't an external cloud provider. Vendor remote access can make the vendor an External Service Provider, which is why there is no standing access: sessions are opened by you, one at a time, logged on the box, and on the Defense build handled by US persons only. List Traveler in your SSP as an ESP for those sessions.
▸Which FIPS module does the box use?
The box uses a FIPS-validated cryptographic module for data at rest and in transit, and the Defense build runs in a hardened FIPS-mode configuration. The control mapping we provide names the specific CMVP certificate numbers so your assessor can check them.
▸What about Section 889 and the hardware?
We source hardware to comply with Section 889 of the FY2019 NDAA and will provide a written attestation on request.