Does a cloud or email host holding CUI need FedRAMP Moderate equivalent security?
Yes, if the host stores, processes or transmits covered defense information. DFARS 252.204-7012(b)(2)(ii)(D) requires an external cloud service provider that handles covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline, along with the clause's incident reporting and forensic support duties. Under 32 CFR 170.16(c)(2) and 170.17(c)(5), a Level 2 cloud offering used for CUI must be FedRAMP Authorized at the Moderate baseline or higher on the FedRAMP Marketplace, or meet equivalent security under DoD policy. The answer for a given organization turns on three facts: which provider and which specific offering hold the data (an email tenant and a storage service from the same vendor can carry different authorization status), whether that offering is FedRAMP Authorized or only claimed as equivalent, and who holds the evidence that proves it.
Start with an inventory. List every external service that touches CUI, including email, file sharing, collaboration tools, backup and ticketing, and record the exact service offering named in the system security plan. For each one, confirm on the FedRAMP Marketplace that the provider, offering, impact level and status match what you are using. If the offering is not listed, you will need the equivalency route, which relies on a documented body of evidence that the provider must supply and keep current. Ask the provider in writing which offering and boundary the authorization covers, and whether your tenant or configuration falls inside it. Confirm the status with the provider rather than assuming a vendor-wide authorization covers every product.
Your organization owns its controls and its contract obligations, and the provider owns its own evidence. An implementation partner can help map the provider's documentation into your system security plan, set up the customer-side settings and collect the evidence you need to show. Only the FedRAMP authorization process or an independent assessor issues an authorization or an assessment outcome, and no partner or consultant can certify a provider as equivalent on your behalf. Before you sign, decide who will request evidence from the provider, how often it must be refreshed, and what happens if the provider's status changes during your contract.
Which cloud route fits: FedRAMP Authorized, equivalent or 252.239-7010?
This table compares the three cloud routes a DoD contractor may face: a FedRAMP Moderate authorized offering, a FedRAMP Moderate equivalent offering under DoD policy, and DFARS 252.239-7010 for cloud services run to deliver IT services for the Government. Read each row against your contract, and confirm with the contracting officer which clause applies before you choose a route.
| Route | Who it applies to | What the provider must show | When it fits |
|---|---|---|---|
| FedRAMP Authorized, Moderate baseline | Contractors storing, processing or transmitting CUI in an external cloud service | A current FedRAMP Moderate (or higher) authorization for the specific offering, listed on the FedRAMP Marketplace | When the provider holds a listed authorization for the exact service named in your system security plan |
| FedRAMP Moderate equivalent under DoD policy | Contractors using an external cloud provider for CUI that lacks a listed authorization | Evidence that meets DoD equivalency policy, with a complete, intact body of evidence within required periodicity, verified by the assessor | When no listed authorization exists but the provider can document equivalent security and the assessor can confirm the evidence |
| DFARS 252.239-7010 cloud services | Contractors running cloud services to deliver IT services in performance of a contract for the Government | Compliance with the DoD Cloud Computing Security Requirements Guide for the required security level | When the cloud is part of the service delivered to the Government, not only a repository for your own CUI |
| Data location for 252.239-7010 | Contractors storing Government data outside DoD premises | Government data kept within the United States or outlying areas | Apply where data leaves DoD premises unless the contracting officer approves another location |
| Confirm the applicable clause | Any contractor choosing a cloud route | Written direction from the contracting officer on which clause governs the specific contract | Before selecting a provider, since the route determines the evidence you must collect |
How DFARS 7012 differs from 252.239-7010 for clouds run for the Government
DFARS 252.239-7010 covers cloud computing used to provide IT services to the Government. When a contractor delivers an IT service to the Government through a cloud, the contractor must meet the DoD Cloud Computing Security Requirements Guide for the impact level the contract requires, and must keep Government data that is not on DoD premises within the United States or outlying areas unless the contracting officer approves another location. The obligation sits with the cloud service the contractor operates for the Government, and the contracting officer's approval controls any data location outside those areas. Before accepting such a task, confirm which impact level the contract names and whether the data location clause has been waived in writing. DFARS 252.204-7012 works differently. It applies when an external cloud service provider stores, processes or transmits covered defense information on the contractor's behalf, which is the common case for a contractor's email host, file sharing platform or collaboration suite. The provider must meet security requirements equivalent to the FedRAMP Moderate baseline, and the clause's incident reporting and forensic support duties apply to it as well. The contractor's own system security plan must name the specific cloud offering, and the reader should check that the offering listed there is the one that actually holds the CUI.
A contractor may fall under one clause, the other, or both, depending on whose system runs the service and whose data it holds. A cloud the contractor runs to deliver services to the Government points toward 252.239-7010, while a commercial cloud that merely hosts the contractor's own covered defense information points toward 252.204-7012. Where the contractor's system does both, both clauses can apply to the same environment. The contracting officer and the contract's terms decide which clause governs, so ask the contracting officer in writing before award how the cloud is to be treated, and record the answer in the contract file and the system security plan.
Who owns the cloud evidence: you, the provider, or the assessor
The contractor remains responsible for the CUI, for the system security plan, and for every NIST SP 800-171 requirement that the cloud service does not cover. The cloud service is one part of the contractor's boundary, not a substitute for the contractor's program. Your team names the specific offering in the system security plan, records how CUI flows into it, and decides who holds which control responsibilities.
- Name the exact offering: Record the provider, service offering and impact level in the system security plan, so the assessor can match it to the authorization evidence.
- Collect provider evidence: Request the authorization package summary, continuous monitoring deliverables and any notices of significant change, and store them with a dated log.
- Keep your own controls running: Access management, audit logging of your users, incident handling and media handling stay with you even when the provider hosts the data.
- Keep incident reporting intact: Your DFARS 252.204-7012 reporting duty and forensic support obligations apply to incidents in the cloud, so confirm how the provider notifies you and how you will meet the reporting window.
- Maintain the evidence set: Re-check the provider's status on the FedRAMP Marketplace on a schedule and update the system security plan when the offering or its status changes.
Before assessment, confirm in writing which party owns each responsibility and where the evidence for it is kept.
The provider owns the security of its platform and produces the evidence that supports a FedRAMP Moderate or Moderate equivalent claim. It cannot certify its own equivalence. For a FedRAMP Authorized offering, the authorization is recorded on the FedRAMP Marketplace. For a claimed equivalent, the provider supplies a body of evidence that an independent assessor can examine.
- Hold the authorization or equivalence basis: Confirm whether the offering is FedRAMP Authorized at the Moderate baseline or claims equivalent security under DoD policy, and state which applies.
- Provide continuous monitoring output: Supply the periodic scans, deliverables and status reports that show the offering is still operated to its baseline.
- Support incident notification and forensics: Agree in the contract how incidents affecting the contractor's CUI are reported, preserved and made available for forensic review.
- Document the data location: State where Government and CUI data is stored and processed, and whether any data leaves the United States.
- Support customer evidence requests: Answer questions from the contractor and assessor about the offering named in the system security plan, including changes that affect it.
Ask the provider for these items before signing, because a provider that cannot produce them will not satisfy the assessor.
The independent assessor, not the provider and not the contractor, decides whether the evidence supports the claim. For a claimed FedRAMP Moderate equivalent, the assessor confirms that the body of evidence is complete, intact and within the required periodicity under current DoD CIO equivalency policy. The assessor does not re-evaluate the provider against FedRAMP Moderate itself. For a FedRAMP Authorized offering, the assessor checks the Marketplace listing.
- Verify the Marketplace listing: Confirm the provider, service offering, impact level and status, and check that the exact offering named in the system security plan is listed.
- Confirm the equivalence evidence set: For an equivalent claim, check that the evidence is complete, unaltered and current within the required periodicity.
- Test the contractor's controls: Examine and interview on the contractor's own NIST SP 800-171 requirements, which the cloud provider does not satisfy on the contractor's behalf.
- Issue the outcome through the proper channel: Only the assessor or the FedRAMP process issues the result. The implementation partner does not issue any report or certificate.
- Note gaps in the record: Missing or stale provider evidence is a finding against the contractor's assessment, not something the assessor fills in.
Ask the assessor early which evidence they will need, so the package can be prepared before the assessment window opens.
What assessors check for a FedRAMP Moderate equivalent claim, and what they do not
An equivalent claim for a cloud offering is checked against a narrow set of questions: is the evidence complete and current, does it match the offering in the SSP, and do the contractor's own controls support the cloud. Assessors do not independently grade the provider against FedRAMP Moderate, so the contractor and the contracting officer carry the rest of the judgment.
Evidence complete, intact and current
The assessor confirms that the provider's body of evidence is complete, intact and within the required periodicity under current DoD CIO equivalency policy. That means the assessment package, continuous monitoring deliverables and any required updates are all present and on schedule. Gaps in dates, missing deliverables or altered documents are the failures to look for before the assessment begins. Ask the provider for its current package index so you can check it yourself.
Offering named in the SSP
The assessor checks that the specific cloud offering named in the system security plan is the one the evidence covers. A provider can hold equivalency for one service and not for another under the same brand, so a mismatch between the SSP entry and the evidence is a finding. Record the exact service name, deployment and region in the SSP, and confirm each one against the provider's documentation.
Contractor controls around the cloud
The cloud provider's evidence does not cover the contractor's own obligations. The contractor still needs its access controls, encryption keys, audit logs, configuration baselines and user training in place for the CUI it puts into the service. The assessor tests those controls against NIST SP 800-171 as part of the contractor's assessment. Identify which controls the contractor inherits from the provider and which it must implement itself.
Incident reporting support from the provider
DFARS 252.204-7012 requires the cloud provider to meet the clause's incident reporting and forensic support requirements. Assessors look for a written commitment that the provider will support reporting within the clause's timeline and preserve the images and data DoD may request. Confirm the contact path, the preservation process and how the provider handles subpoenas or access requests for CUI.
What assessors do not evaluate
An assessor under CAP v2.0 does not evaluate the cloud offering against FedRAMP Moderate. Their task is to confirm the evidence is complete and current under DoD equivalency policy, not to re-test the provider's controls. A clean assessment therefore does not prove the provider is secure in the way a FedRAMP authorization does. The contractor should not treat an assessor's acceptance as independent confirmation of the provider's security posture.
Confirm equivalency policy with the contracting officer
Equivalency is judged under current DoD CIO policy, and that policy can change. Before relying on an equivalent claim, ask the contracting officer which policy applies to the contract and whether the offering is acceptable under it. Record the answer in writing in the contract file. Ask as well whether the deviation or CMMC phase changes the applicable baseline for your contract.
What the MORSECORP settlement shows about a third-party email host
The March 2025 MORSECORP settlement shows that a third-party email host can put a defense contractor's compliance representations at risk, even when no one treats that host as a cloud project. According to the US Department of Justice release, MORSECORP agreed to pay $4.6 million to resolve cybersecurity fraud allegations. The company admitted that from January 2018 it used a third-party email host without ensuring FedRAMP Moderate equivalent security for that service. It also admitted it had not implemented all NIST SP 800-171 controls and did not have a consolidated system security plan until January 2021.
The lesson for buyers is that a mail service is in scope whenever it stores, processes or transmits covered defense information. Email is often bought as a convenience and handled outside the security program, so the host never appears in the system security plan. Under DFARS 252.204-7012, the external cloud service provider must meet FedRAMP Moderate equivalent requirements, and the host must be named, with its boundary and responsibilities, in the SSP. Before you sign or renew, confirm whether any mailbox, archive, relay or collaboration add-on carries CUI, and check whether the provider's offering appears on the FedRAMP Marketplace or has an equivalency basis you can document.
The settlement also shows where False Claims Act exposure comes from. The liability followed from the representations the company made about its compliance, not only from the gap itself. Treat every compliance statement, including SPRS entries and SSP descriptions, as a claim that must match the evidence. Ask your email provider for its FedRAMP authorization details, the specific service and impact level, and the evidence you need for your own assessment. Your counsel should review any statement that the environment meets the clause, and your team should confirm that the SSP reflects the system as it runs today.
Pitfalls that leave CUI in an email or cloud service nobody verified
Most DFARS 7012 cloud failures are not exotic. They come from assuming a provider is covered, from tenants nobody recorded, and from side channels that carry CUI outside the system the contractor assessed. Each card below names one of these gaps and a first step to close it.
Assuming a commercial product is FedRAMP Moderate
A large provider's commercial product line is not automatically FedRAMP Moderate authorized. Authorization attaches to a specific service offering at a stated impact level, and the Marketplace lists each one separately. Before relying on a provider, open the FedRAMP Marketplace and confirm the provider, the exact offering, the Moderate impact level and the current status. Start this week by pulling that listing for every cloud service that touches CUI.
Using a tenant missing from the SSP
CUI often sits in a cloud tenant, mailbox or workspace that was provisioned after the system security plan was written, or by a team that did not tell the compliance owner. An assessor checks whether the offering named in the SSP is the one actually holding CUI. Ask IT to export a list of all tenants and subscriptions under the company domain, then reconcile that list against the SSP boundary.
Treating Azure as holding a CMMC certification
Microsoft states that CMMC does not apply directly to cloud services, so there is no CMMC certification for a platform such as Azure. The contractor is responsible for confirming that the underlying platform holds at least FedRAMP Moderate authorization and for documenting that in its own assessment. A vendor brochure or a CMMC badge in a sales deck does not satisfy this. Start this week by replacing any CMMC claim about a cloud platform in your SSP with a Marketplace reference.
Shadow forwarders and file shares
A mail rule that forwards messages to a personal or unmanaged mailbox, or a shared folder synced to an unassessed service, can move CUI outside the authorized environment without anyone deciding to do it. The MORSECORP settlement involved a third-party email host that was not verified as FedRAMP Moderate equivalent. Review mail flow rules, auto-forwarding settings and sync clients, and block forwarding to domains outside the boundary.
Not recording the Marketplace check
A verification done once and never written down cannot be shown to an assessor. Record the Marketplace listing, the offering name, the impact level, the status and the date you checked it, and store that record with the SSP evidence. Repeat the check on a schedule and whenever the provider changes its offering. Start this week by adding a dated verification row for each cloud or email service in your evidence folder.
Questions buyers ask about FedRAMP Moderate equivalent cloud requirements
Does a cloud provider storing CUI need a FedRAMP Authorized offering?
Usually yes, unless the provider meets equivalent security under DoD policy. Under 32 CFR 170.16(c)(2) and 170.17(c)(5), a contractor may use a cloud offering for CUI at CMMC Level 2 only if the offering is FedRAMP Authorized at the Moderate baseline or higher on the FedRAMP Marketplace, or meets equivalent security requirements in accordance with DoD policy. DFARS 252.204-7012 applies the same expectation to external cloud service providers that store, process or transmit covered defense information. The contractor should first identify every cloud service that touches CUI, then confirm which of the two paths each one relies on. Ask the provider for its authorization record or its equivalency evidence in writing before you rely on it.
Does Microsoft's CMMC statement cover my own DFARS obligations for Azure?
No. Microsoft states that CMMC does not apply directly to cloud services, so there is no CMMC certification for a cloud platform such as Azure. The contractor remains responsible for its own compliance and must ensure the underlying platform holds at least FedRAMP Moderate authorization for the specific services that handle CUI. A vendor's compliance documentation is useful evidence, but it does not replace your own check of the offering's status and scope. Confirm the service names, impact level and authorization status against the FedRAMP Marketplace, and record the result in your system security plan.
What will an assessor check for a cloud offering claimed as FedRAMP Moderate equivalent?
For an equivalent offering, the assessor confirms that the provider's body of evidence is complete, intact and delivered within the required periodicity under current DoD CIO equivalency policy. Under CAP v2.0, the assessor does not evaluate the offering against FedRAMP Moderate itself. The assessor will not re-test the provider's controls, rebuild the authorization package or certify that the provider is secure. Expect questions about whether evidence is current and whether the contractor's system security plan describes how the cloud service is used. Ask your assessor to confirm, before the assessment starts, exactly which evidence items they will review.
Can the contractor check FedRAMP Marketplace status without outside help?
Yes. Contractors can run this check themselves. CAP v2.0 directs assessors to verify a FedRAMP Moderate authorization by provider, service offering, impact level and status, and to confirm that the specific offering named in the system security plan is listed. Pull the offering name exactly as it appears in your SSP, search the FedRAMP Marketplace, and compare the provider, offering, impact level and status. Save a dated copy of the listing. Note that a provider can hold authorization for one offering but not for an adjacent service, so a match on the company name alone is not enough.
What evidence must the contractor collect from its cloud provider?
The contractor must collect the provider's authorization or equivalency evidence and enough contract detail to show how CUI is handled. In practice this includes the provider's authorization listing or equivalency package, the service model and data locations, the responsibility matrix that separates provider and customer controls, and incident reporting terms that support the 72-hour reporting and forensic support duties in the clause. For cloud services used to provide IT services under a contract, DFARS 252.239-7010 may also apply, so check whether data outside DoD premises must stay within the United States or outlying areas. Request these items during procurement, not after an incident. The exact list depends on the provider and contract, so confirm it with the contracting officer and your assessor.
Who issues the authorization or assessment outcome for a cloud offering?
The FedRAMP authorization process and an independent assessor issue the outcomes, not an implementation partner. A FedRAMP Moderate authorization comes from the FedRAMP process for the provider's offering. An equivalency outcome is reached through an independent assessment under DoD policy. DeployOpen prepares systems, controls and evidence for compliance assessments, including documentation of how a cloud service is configured and monitored, but it does not issue audit reports, attestations or certifications. Be wary of any partner that claims to certify a cloud offering on your behalf.
Can an implementation partner prepare the cloud evidence for us?
Yes, an implementation partner can help assemble and organize the evidence, but the contractor still owns its controls and its representations to the government. DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside a client's own infrastructure, and it prepares systems and evidence for compliance assessments. Where the cloud service is provider-hosted, the partner can map which controls the provider covers and which the contractor must run, then prepare the contractor's side of the evidence. Engagements are usually fixed-scope, so agree in writing which cloud services, evidence items and deliverables are included before work starts, and ask for a written quote based on that scope.
What drives the cost of a cloud compliance review?
The main drivers are the number of cloud services that handle CUI, how much of the evidence the provider already supplies, and how well the system security plan describes the boundary. Costs usually split into one-time work, such as scoping, documentation and gap closure, and recurring work, such as keeping the Marketplace check current and collecting refreshed provider evidence. Your own assessor's fees are a separate line item paid directly to that assessor. This page does not state a price or duration, because no researched figure for this work is available. Ask any quote to itemize scoping, evidence collection, documentation, assessor fees and any ongoing review, and confirm which items recur each year.
How DeployOpen prepares CUI cloud and email evidence
DeployOpen works on the self-hosted side of DFARS 7012 cloud requirements: FedRAMP Moderate equivalent, preparing systems, configuration and evidence inside your own infrastructure. We do not issue FedRAMP authorizations, equivalency determinations or assessment results; those come from the cloud provider, the Government and independent assessors.
How we scope
- We confirm which systems store, process or transmit CUI, including any email or collaboration service in the data path.
- Engagements are fixed-scope, with the systems, deliverables and timelines agreed in writing before work starts.
- We identify which hosted components need FedRAMP Moderate or equivalent evidence from the provider, and which remain yours to implement.
How we build
- We deploy and harden open-source platforms in your cloud accounts, data centers or air-gapped networks.
- We configure logging, access control, encryption and backup so the SSP statements match the running systems.
- We test the configuration against the requirements in scope and record the results for your assessor to examine.
How we hand over
- We document architecture, boundaries and data flows so the system security plan describes the system as built.
- We deliver a provider evidence register listing each FedRAMP Moderate claim, its source and its review date for your team to confirm.
- We train your administrators on the procedures and records that your assessor will ask them to produce.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
- We help refresh evidence when a provider's authorization status, service offering or DoD equivalency policy changes.
- Before any assessment, confirm with your assessor which evidence they will accept and how often they expect it refreshed.
