Tools
Before CUI goes into a cloud service
Use this check for every cloud service that will store, process or send CUI: email, file storage, backup, a security tool that holds CUI or data about your CUI systems. It works the same whichever product is named in a practice on this site: a product's name is where the check starts, not the answer. A vendor's statement that its service is FedRAMP equivalent or meets DFARS 252.204-7012 is the vendor's claim until you hold the documents below.
1Name the exact offering, not the vendor
Providers sell several offerings under one brand: commercial and government versions, regions, plans. Authorization and equivalency belong to one offering. Write down the offering's exact name as the provider lists it and the plan you bought.
“The CSP product or service offering is FedRAMP Authorized at the FedRAMP Moderate (or higher) baseline in accordance with the FedRAMP Marketplace”
Collect
- The offering's exact name, as the provider lists it
- Your order or subscription showing that offering and plan
2Decide which route applies
There are two routes. Either the offering is FedRAMP Moderate (or higher) Authorized on the FedRAMP Marketplace, or it is not and must meet requirements equivalent to the FedRAMP Moderate baseline, as DoD policy defines them. The DoD policy is the DoD CIO memorandum quoted in step 4.
“The CSP product or service offering is not FedRAMP Authorized at the FedRAMP Moderate (or higher) baseline but meets security requirements equivalent to those established by the FedRAMP Moderate (or higher) baseline. FedRAMP Moderate or FedRAMP Moderate equivalent is in accordance with DoD Policy.”
“the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline”
Collect
- A note of which route applies, and why
4Equivalent: get the body of evidence the memorandum requires
For an offering that is not on the Marketplace at Moderate or higher, the DoD CIO memorandum of December 21, 2023 says what equivalency takes. You must check the body of evidence yourself; holding the vendor's word, or this site's mention of the product, is not the check.
“To be considered FedRAMP Moderate equivalent, CSOs must achieve 100 percent compliance with the latest FedRAMP moderate security control baseline through an assessment conducted by a FedRAMP-recognized Third Party Assessment Organization (3PAO) and present the following supporting documentation to the contractor as the body of evidence (BoE):”
“DoD requirements for FedRAMP Moderate Equivalency do not allow for POA&M's resulting from a 3PAO assessment of the CSP's CSO. All POA&M actions must be corrected and validated by the 3PAO as closed.”
“The onus is on the contractor to validate the BoE provided by the 3PAO meets the Moderate Equivalent standards outlined in this memo”
“This memorandum does not confer FedRAMP Moderate Authorization to CSOs that meet the criteria for equivalency.”
Collect
- System Security Plan (SSP), with the attachments the memorandum lists under it (policies and procedures, user guide, digital identity worksheet, rules of behavior, contingency plan, incident response plan, configuration management plan, control implementation summary workbook, FIPS 199, separation of duties matrix, applicable laws, integrated inventory workbook)
- Security Assessment Plan (SAP), including the penetration testing plan validated by a FedRAMP-recognized 3PAO
- Security Assessment Report (SAR) performed by a FedRAMP-recognized 3PAO, with its scan results and penetration test reports
- Plan of Action and Milestones (POA&M), showing no open items from the 3PAO assessment, with the continuous monitoring strategy and monthly executive summary
- Your own note of how you checked the body of evidence against the memorandum, and the name of the 3PAO
5Confirm the tenant and deployment you actually use
The listing or the body of evidence covers one offering. Check that your tenant, environment and region are that offering (for example a government cloud tenant, not the commercial one with the same product name), and that the features you rely on are inside it.
Collect
- A screenshot or export from the admin console showing the environment and region of your tenant
6Carry the customer responsibility matrix into your SSP
The provider's customer responsibility matrix says which requirements it meets and which stay yours. The rule puts the customer side in your SSP, and for an equivalent offering you give the matrix to the assessors.
“the security requirements from the Customer Responsibility Matrix (CRM) must be documented or referred to in the OSA's System Security Plan (SSP)”
“must provide the CRM to DIBCAC and 3PAO assessors to support assessments”
Collect
- The provider's customer responsibility matrix for this offering
- The SSP section that lists or refers to each customer responsibility and how you meet it
7Make sure the provider supports what DFARS 252.204-7012 asks
When the clause is in your contract, the provider must support incident reporting, malicious software submission, media preservation, forensic access and damage assessment, and you stay the one who reports to DoD. See IR.L2-3.6.2 for the reporting duty itself.
“complies with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment”
“The contractor acts as approver for the use of the CSO by their organization and confirms that the selected CSP has an incident response plan.”
“The contractor, not the CSO's CSP, will be held responsible for reporting in the event of CSO compromise.”
Collect
- The contract terms or provider statement covering paragraphs (c) to (g) of the clause, including how and how fast the provider notifies you
- Confirmation that the provider has an incident response plan, and its contact for incidents
8Record who checked, when, and where the evidence is kept
Keep one record per offering, and check it again when the subscription renews, when the Marketplace status or the provider's assessment changes, or before an assessment. Every practice that relies on the service points to this one record.
Collect
- The cloud service check record: offering, route, what was checked, by whom, the date, and where each document above is kept
Keep the completed check as one record per service: it appears in the evidence register as the cloud service check record, and every practice that relies on the service points to it.
Quotes checked against the official texts in Expert CMMC's standards library on November 11, 2026. The DoD CIO memorandum is a scanned document; its text was recognised and checked against the page images. This page is Expert CMMC's guidance, not an official determination about any service.