How self-hosted file sharing supports CMMC Level 2 for CUI
A self-hosted Nextcloud enclave can serve AC.L2-3.1.3 (controlling the flow of CUI), SC.L2-3.13.11 (FIPS-validated cryptography) and SC.L2-3.13.16 (protecting CUI at rest), but no platform satisfies these requirements by itself. A defense contractor whose engineers share drawings, specifications and program documents through sync clients and external links has to show where CUI goes, who authorized each path and how the platform enforces those decisions. The enclave supplies the mechanisms (group-based sharing rules, disabled or restricted external shares, server-side encryption modules, storage on infrastructure the contractor controls), while the organization supplies the policy, the documented authorizations and the evidence that those settings were operating as described.
Level 2 rests on the 110 requirements of NIST SP 800-171 Rev. 2, which 32 CFR 170.14(c)(3) incorporates unchanged into the CMMC Level 2 model. Assessments are run against the objectives in NIST SP 800-171A (June 2018), and a requirement counts as MET only when every applicable objective is satisfied with evidence in final form, not drafts. For AC.L2-3.1.3, that means documented flow policies, designated sources and destinations of CUI, and enforced authorizations. For SC.L2-3.13.11, the point of the 3-point and 5-point scoring under 32 CFR 170.24 is that the encryption module must be FIPS-validated, so confirm the validation certificate for the exact Nextcloud build and PHP runtime you deploy rather than assuming it.
The Department of War suspended CMMC Phase II on 13 July 2026, which removed the scheduled C3PAO certification requirement for applicable contracts. Phase I obligations remain in place: self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations. Because the official pages and the eCFR text currently differ on the phase schedule, confirm the current requirements with your contracting officer and counsel before each submission. Plan the enclave as if the assessment will happen, and document the hosting boundary, the systems in scope and the evidence for each objective now, since those artifacts are what a later assessment and any SPRS score will rest on.
Mapping AC.L2-3.1.3, SC.L2-3.13.11 and SC.L2-3.13.16 to Nextcloud configuration
This table compares each of the three CMMC Level 2 requirements against what the enclave must do, what the Nextcloud configuration should contain and where assessments commonly fail. Read each row as a checklist of design decisions to confirm with your assessor and your hosting team before scoping begins. The main takeaway is that all three requirements depend on the hosting boundary: a control only counts if it runs inside the assessed environment.
| Requirement | What the function must do | Configuration to confirm in Nextcloud |
|---|---|---|
| AC.L2-3.1.3 (controlling CUI flow) | Define information flow control policies, the methods and enforcement mechanisms, the designated sources and destinations of CUI, and the approved flow authorizations, then enforce them. Scored as 1 point. | Group-based sharing rules limiting who can share CUI folders, disabled or restricted public link sharing, external sharing limited to approved guest groups, and access control rules by group or network. Document each rule against the approved authorization it enforces. |
| AC.L2-3.1.3 (evidence and failure points) | Show that the flow policy exists, that sources and destinations are named, and that the enforcement mechanism actually blocks unapproved flows, with evidence in final form. | Exported sharing settings and audit log samples showing blocked or permitted flows. Common failure: a policy document that does not match the live configuration, or sync clients and external storage mounts that bypass the rules. |
| SC.L2-3.13.11 (FIPS-validated cryptography) | Employ FIPS-validated cryptography wherever it protects CUI confidentiality, including TLS for transmission and encryption at rest. Scored at 5 points if encryption is absent and 3 points if encryption is used without FIPS validation. | TLS termination with approved cipher configuration, server-side encryption enabled, and a cryptographic module whose validation status is confirmed by the vendor for the exact version deployed. Do not assume FIPS validation from a general statement about the product. |
| SC.L2-3.13.11 (scoring and POA&M) | Only the 3-point case may be placed on a POA&M under the CMMC scoring rules, so unencrypted storage is a far larger scoring risk than a validation gap. | Confirm with the vendor and your C3PAO or assessor whether the cryptographic modules in use are FIPS-validated, which modules and versions, and how the operating system and database layers are covered. Record the answer with its source. |
| SC.L2-3.13.16 (CUI at rest) | Protect the confidentiality of CUI stored on the platform, including file content, previews, versions, trash and backups. | Server-side encryption with keys held under organizational control, storage on encrypted volumes, and backups encrypted with the same care. Confirm that trash, versions and thumbnails are covered by the same encryption scope. |
| SC.L2-3.13.16 (evidence and failure points) | Show that CUI at rest is protected across every storage location in the enclave boundary, not only the primary data directory. | Storage architecture diagram, key custody records and backup encryption settings. Common failure: database, cache or object storage holding CUI metadata or file fragments outside the encrypted scope. |
| Hosting boundary (all three) | Every system that stores, transmits or processes CUI must sit inside the defined assessment scope, or be shown to be out of it. | Confirm the hosting location, administrator access paths, backup targets and any third-party services such as email notifications or antivirus updates. Each one can pull the Nextcloud deployment into scope. |
Which open-source platforms fit a CUI enclave
A CUI enclave is only as strong as the weakest component that touches controlled files. The cards below cover the core sync platform, a simpler alternative, the office editors that run beside it, and the bundled services whose cryptography must be checked against the FIPS requirement before they go inside the enclave boundary.
Nextcloud Server as the enclave core
Nextcloud Server is licensed under AGPL-3.0, so the enclave team can review and modify the code it runs. Major releases arrive about every four months, and each is supported for one year, so the team must plan one major upgrade at a time and keep the enclave on a supported line. Check that the version you deploy has a documented lifecycle that fits your assessment calendar.
Nextcloud Enterprise support tiers
Nextcloud GmbH sells Nextcloud Enterprise alongside the community version, aimed at enterprise and public sector users. Tiers differ in maintenance lifecycle, support hours and response times, which affects how long a CUI enclave can stay on one release. Confirm with the vendor whether the tier you buy covers the cluster design, the support window your incident process needs, and the lifecycle your assessment plan assumes.
Seafile as a simpler sync option
Seafile server is released under GPLv2 with an additional permission to link with OpenSSL, which matters when the enclave relies on OpenSSL-based cryptographic modules. Seafile is a narrower product than Nextcloud, with fewer bundled office, chat and calendar features. Choose it only if the enclave needs sync and share alone, and confirm which module performs its encryption and whether that module carries a FIPS validation.
ONLYOFFICE Docs for browser editing
ONLYOFFICE Docs is an office suite for documents, spreadsheets, presentations, forms and PDF, compatible with Office Open XML and licensed under AGPL-3.0. Because it renders CUI in the browser, the document server becomes part of the enclave boundary and must run on enclave infrastructure with the same access controls as the file store. Confirm how its editing sessions handle temporary files and whether its encryption path meets the enclave's FIPS requirement.
Collabora Online for browser editing
Collabora Online source code is licensed under the Mozilla Public License 2.0, a file-level copyleft license that differs from the AGPL terms used by other components in this stack. Like ONLYOFFICE, it processes CUI in the browser session, so the enclave must control where its servers run and what they log. Verify that it is integrated with Nextcloud in a configuration your team can document and that its traffic stays inside the enclave network.
Bundled services need FIPS review
Nextcloud All-in-One bundles Redis and APCu caching, PostgreSQL, ClamAV antivirus and BorgBackup, plus optional office and Talk components. Each bundled service handles CUI or its metadata, so each needs its own cryptography check against SC.L2-3.13.11. Ask the implementation partner to list every container, the cryptographic library it uses and whether that library is FIPS-validated, and to document what stays outside the boundary.
Why the hosting boundary sets the CMMC assessment scope
The hosting boundary decides how much of your environment an assessor will examine. Every system that stores, processes or transmits CUI falls inside the assessment scope, and so do the security protection assets that defend those systems, such as identity sources, logging, endpoints and the people who administer them. A self-hosted Nextcloud enclave makes that scope definable: you can draw a network boundary around the file platform, name the directory or identity provider that authenticates its users, and restrict administrator access to a small, documented group. Each of those decisions determines which components the assessor must trace.
A separate enclave limits what is assessed because CUI stays inside a bounded set of hosts, databases, storage back ends, backup targets and admin workstations. Mixing CUI and non-CUI data on shared infrastructure widens the scope, because any shared server, shared domain administrator or shared backup job that touches CUI brings its own controls into the assessment. Before you design the enclave, map every data path: user devices, sync clients, external storage mounts, Office editing components, mail notifications and backup repositories. Each path that carries CUI should appear in your System Security Plan with its authorized sources, destinations and flow rules, which is the evidence that AC.L2-3.1.3 asks for.
Confirm the boundary with your C3PAO or your sponsoring contracting officer before you build, and check the scoping logic against the DoW CIO CMMC Assessment Guide, Level 2. Ask in writing which assets are in scope, whether an external hosting provider or MSP counts as a component, and how they treat shared administrators. DeployOpen builds, hardens and documents self-hosted enclaves and prepares the evidence for assessment, but DeployOpen does not issue assessment results, scores or certifications. Those decisions belong to the assessor and the Department of War's processes.
Keeping the enclave supported while the framework moves
This sequence keeps the Nextcloud enclave on a supported release and keeps the team's evidence aligned with the NIST SP 800-171 revision the assessor will apply. Each step ends with a record that an auditor can inspect.
Confirm the supported Nextcloud release
The platform owner checks the running Nextcloud version against the maintenance and release schedule and records the end-of-life date for that branch. Nextcloud 35 was released on 16 September 2026 with end of life in September 2027, Nextcloud 34 is supported until June 2027, and Nextcloud 33 until February 2027. The step closes when the version, its support end date and the next planned major release are written into the system security plan and the change calendar.
Inventory third-party apps and their compatibility
The administrator lists every installed app, its source and its maintainer, then compares each one against the target major version. Apps without a confirmed compatibility statement stay disabled until the vendor or the DeployOpen team tests them on a staging copy. The output is a signed inventory that shows each app as enabled, disabled or retired, and the enclave's documented baseline includes only the apps that the security plan names.
Stage the upgrade in a non-production copy
The team clones the production database, data directory and configuration into an isolated staging environment inside the enclave boundary and runs the planned upgrade there first. Testing covers login through the directory integration, sync client connections, external share links, audit log output and encryption settings. The step closes with a test record showing which functions passed, which failed and what was changed to fix them.
Back up before each major step
Before every upgrade the operator takes a full backup of the database, the data directory and the configuration, and verifies that the backup can be restored. Nextcloud does not allow skipping major releases, so a backup taken before one step becomes the rollback point for that step only. The step closes when the backup set, its checksum and the restore test result are recorded in the change ticket.
Upgrade one major version at a time
The operator moves the enclave to the next major version in sequence, never jumping over a release, and runs the upgrade with third-party apps still disabled. After the upgrade, the team checks the server logs, the admin overview warnings and the audit log to confirm that CUI access controls and logging still operate. The step closes when the upgraded version, the verification results and the change approval are filed together.
Re-enable apps only after confirmation
Each app returns to production only after its compatibility is confirmed for the new version and its effect on access control, encryption and logging has been tested. The change owner enables apps one at a time, so that any fault traces to a single change. The step closes when the updated app inventory matches the system security plan and each newly enabled app has a documented test result.
Track the NIST SP 800-171 revision in force
The compliance lead tracks the status of NIST SP 800-171 Rev. 2 and Rev. 3 and the CMMC rule's reference to Rev. 2. The Department of War has said on 13 July 2026 that it will enforce Rev. 2 in the interim, so the enclave's control mapping stays on Rev. 2 until the rule changes. The step closes when the control mapping, the assessment objectives in NIST SP 800-171A and the open questions to confirm with the sponsor are reviewed and dated, and any change in the enforced revision triggers a new mapping review.
Repeat the cycle and retain the evidence
The team reruns the sequence at each planned release window, starting again with the support check, and keeps every record in one evidence folder that matches the system security plan. Before each assessment, the compliance lead confirms that evidence is in final form, not drafts, as the assessment rules require. The step closes when an independent reviewer can trace each upgrade from its support check to its signed test and backup records.
Evidence assessors ask for and which component produces it
This table maps the evidence an assessor expects for AC.L2-3.1.3, SC.L2-3.13.11 and SC.L2-3.13.16 to the Nextcloud component or operating record that produces it. Read each row as a question the assessor will ask, the artifact that answers it, and the scoring consequence if the answer is missing.
| Evidence item | Component or record that produces it | Requirement and scoring implication |
|---|---|---|
| Documented CUI flow authorizations and policy | Written information flow policy listing approved sources, destinations and authorized groups, matched to exported group and share configuration | AC.L2-3.1.3 (1 point). Assessors check that the policy defines flow control and that enforced settings match it. |
| Group and share configuration export | Exported Nextcloud group membership, folder sharing rules and external storage mounts, captured in final form with date and configuration version | AC.L2-3.1.3 (1 point). Shows enforcement of approved authorizations, not just a stated intent. |
| External share and link settings | Exported sharing policy covering internal and external shares, link expiry, password requirements and restrictions on sharing outside approved domains | AC.L2-3.1.3 (1 point). Confirms designated CUI destinations are the only ones permitted. |
| Audit logs of CUI access and sharing | Nextcloud audit log output, retained and forwarded to a log store the organization controls, with examples of CUI folder access and share events | Supports the monitoring and review evidence for AC.L2-3.1.3 enforcement. Confirm log retention with the assessor's expectations. |
| Encryption in transit configuration | TLS configuration for the Nextcloud endpoint and reverse proxy, with the cipher and protocol settings in use | SC.L2-3.13.11 (5 points if no encryption, 3 points if encryption is used without FIPS validation). Assessors also check the FIPS-validated module used by the encryption path. |
| FIPS module evidence | Documentation of the cryptographic module in use, its validation certificate number from the NIST CMVP listing and the configuration that forces its use | SC.L2-3.13.11 is the only requirement above 1 point that may go on a POA&M, and only in the 3-point case. Confirm the module and its certificate with your environment and vendor. |
| At-rest encryption and key management records | Server-side encryption settings, key storage location, key rotation records and the custodian list for the master key | SC.L2-3.13.16 (CUI at rest). Assessors test that stored CUI is protected and that key custody is documented. |
| System security plan and POA&M entries | SSP describing the Nextcloud enclave boundary, data flows and components, plus POA&M entries only where 32 CFR 170 permits | POA&M eligibility depends on requirement point value and scoring. AC.L2-3.1.3 may be placed on a POA&M for Conditional Level 2 at 88 of 110 with closeout within 180 days. |
| Final-form evidence, not drafts | Dated, approved versions of policy, configuration exports, log extracts and key records, held under change control | Under 32 CFR 170 a requirement is MET only with evidence in final form. Drafts do not satisfy the assessment objectives in NIST SP 800-171A. |
What Nextcloud configuration alone does not satisfy
A correctly configured Nextcloud enclave covers only part of the assessment. The cards below name the controls that sit outside the file platform and remain the organization's responsibility, whether it runs the platform itself or hires a partner. Each one should be checked against the scope of the enclave before the assessment date is set.
System security plan and policies
The system security plan describes how each of the 110 requirements is implemented, by which system, and who operates it. Nextcloud configuration produces evidence for a few requirements, but the plan, access control policy, and change management procedures are documents the organization must write, approve and keep current. Assessors check that these documents match what the enclave actually does, so confirm that every configuration setting cited in the plan is still in place at assessment time.
Personnel, training and access reviews
Requirements for personnel screening, security awareness and periodic access reviews apply to people, not to the file platform. Administrators, help desk staff and anyone who can add external shares need documented training and named roles. Ask who reviews the list of Nextcloud administrators and guest accounts, how often, and where that review is recorded.
Incident response and reporting
DFARS 252.204-7012 expects a contractor to report cyber incidents affecting covered defense information within a defined window, and the incident response plan has to name who decides, who calls the DoD and who preserves logs. Nextcloud audit logs help with the investigation but do not replace a tested runbook. Confirm that logs are forwarded to a system the file administrators cannot alter.
Endpoint, network and logging controls
The enclave sits inside a wider boundary. Laptops that sync CUI need encryption, screen locking and malware protection. Network segmentation, firewall rules and remote access paths determine who can reach the Nextcloud server at all. Centralized logging, time synchronization and log retention must cover the server, database, reverse proxy and identity provider, not only the application.
Vendor and hosting responsibilities
Any cloud provider, colocation facility, managed service or support partner that stores, processes or can administer the enclave becomes part of the assessment scope. Contracts should state the responsibilities for each control, and the organization must hold evidence for the provider's part. Support engagements that give a partner administrative access need the same review as employees with that access.
FIPS validation for every encryption path
SC.L2-3.13.11 turns on whether the cryptographic modules are FIPS-validated, not just whether encryption is switched on. Each path needs checking: TLS at the reverse proxy, database connections, Redis, backup repositories, sync clients on each operating system, and any mobile apps. Nextcloud documentation and the module certificates identify which components qualify, and a gap in one path can move the score.
Assessment timing after the Phase II suspension
On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Confirm with the contracting officer which assessment applies to each contract and when, because the certification window may move again after the 60-day review.
Questions buyers ask before a CUI file sharing project
How long does a CMMC-aligned Nextcloud enclave take to build?
The duration depends on the scope you agree in writing, not on a fixed template. The main drivers are how many systems touch CUI, how much your identity provider and network segmentation already meet the access control and boundary expectations, whether you need Nextcloud Enterprise or a community deployment, how many existing shares must be migrated, and how quickly your team can review and approve design decisions. Ask any partner for a schedule tied to named deliverables and milestones, and confirm which evidence your assessor expects before work starts, since evidence gathered late often takes the longest.
Can DeployOpen prepare CMMC evidence, and can it certify our environment?
DeployOpen can plan, implement and document the enclave, and prepare the systems, controls and evidence that map to the Level 2 requirements for your assessment. It does not issue audit reports, attestations or certifications. For Level 2 certification assessments, the work is performed by an assessor authorized or accredited through The Cyber AB, and your self-assessment must be based on the NIST SP 800-171A assessment objectives, with evidence in final form. Confirm with your contracting officer and your assessor which assessment type applies to your contracts before you define the scope.
Can our own team run a CUI enclave after it is built?
Yes, many organizations operate the platform internally after handover, but the decision depends on skills and staffing rather than on the software itself. Your team will need to handle patching, monthly maintenance releases, major upgrades that move one major version at a time with backups before each step, third-party app compatibility checks, access reviews and log review. Nextcloud documents these procedures publicly. Ask a partner for a written handover covering runbooks, administrator training and the operating model, and decide in advance whether ongoing support will come from internal staff, a retainer or both.
How much does Nextcloud Enterprise cost compared with the community edition?
The community edition is free to download under AGPL-3.0, so the cost difference lies in the subscription and in the work you pay for around it. Nextcloud Enterprise is sold in Standard, Premium and Ultimate tiers with a 100-user minimum. According to Nextcloud's pricing page, list prices start at 71.29 euros, 104.99 euros and 204.75 euros per user per year respectively for 100 or more users, with lower rates from 200 users. Standard includes one year of maintenance, Premium adds a lifecycle of five or more years and clustered instance support, and Ultimate adds support up to 24/7 with response times down to one hour. Confirm current pricing with Nextcloud, and include administration time, hosting and implementation in your comparison.
What does the project need from our internal team?
The project needs named owners on your side, and the most common delays come from unclear ownership rather than from technical work. Expect to involve a compliance lead who can define the CUI data flows, an identity owner for directory integration, a network owner for segmentation and boundary decisions, storage and backup owners, and business leads who can approve user groups and sharing rules. Your team also needs to supply current inventories of where CUI lives today, existing contracts and SPRS details, and time for review of design and evidence drafts. Ask any partner to list these roles in the written scope.
How does the Phase II suspension change our CMMC planning?
The suspension of Phase II, announced on 13 July 2026, pauses the start that had been scheduled for 10 November 2026 and the certification requirement that came with it, while a 60-day review by a CMMC Reform Task Force takes place. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so the CUI protections still apply to your contracts today. Plan the enclave against the requirements you must meet now, and track the Reform Task Force outcome and the eCFR schedule, which still shows the original phases. Confirm your current obligations with your contracting officer rather than relying on the timeline alone.
Which CMMC requirements should a Nextcloud enclave be designed around first?
Start with the requirements that define where CUI can go and how it is protected in storage and transit. The three most design-sensitive are AC.L2-3.1.3, which covers controlling the flow of CUI under approved authorizations, SC.L2-3.13.11, which calls for FIPS-validated cryptography when encryption protects CUI confidentiality, and SC.L2-3.13.16, which calls for protecting CUI at rest. Under 32 CFR 170.24, SC.L2-3.13.11 carries a 5-point score if encryption is not employed and 3 points if encryption is used without FIPS validation, so confirm the cryptographic modules with your assessor early. Map each design choice to the NIST SP 800-171A objectives before you configure sharing, external links and storage.
What the Phase II suspension changes and what it does not
The Department of War suspended CMMC Phase II on 13 July 2026. Phase II had been scheduled to start 10 November 2026 and would have required Level 2 certification by a C3PAO for applicable contracts. The suspension also paused later implementation milestones and started a 60-day review by a CMMC Reform Task Force. For a defense contractor planning a Nextcloud enclave, the practical effect is that third-party certification is not the near-term gate it was expected to be. The security requirements themselves did not change, and the enclave still has to be built to meet them.
Several obligations remain in force regardless of the suspension. Phase I self-assessments, SPRS postings, annual affirmations and the safeguarding and incident reporting duties of DFARS 252.204-7012 still apply. The DoW CIO's About CMMC page states that, as of 17 October 2026, implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule, so the regulation and the current department guidance do not match on timing. Do not treat the published schedule as the operative one without checking the current guidance first.
Confirm current obligations with your contracting officer before you scope the enclave or decide what evidence to produce. Ask which CMMC level and self-assessment or certification requirement appears in each contract, whether the contract carries DFARS 252.204-7012 and how the SPRS score must be posted and affirmed. Ask also how the Reform Task Force review may change the timeline. Record the answers in writing, because the enclave's assessment boundary and evidence plan depend on them.
How DeployOpen scopes and delivers a CMMC-aligned file enclave
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks. For a CUI file enclave, that means fixing the enclave boundary and the evidence set before any build starts, then delivering a Nextcloud environment and the documentation an assessor will ask for. DeployOpen prepares systems and evidence for assessment but does not issue assessment results or certifications.
How we scope
- Written scope names which users, groups, CUI workflows and external sharing paths sit inside the enclave boundary.
- We map each in-scope workflow to the Level 2 practices for CUI flow, encryption and encryption at rest.
- The scope states which hosting, backup, identity and endpoint components are inside or outside the assessed system.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.
How we build
- We deploy Nextcloud in the client's controlled infrastructure with the database, cache and storage placed inside the enclave.
- Directory integration, access rules, sharing restrictions and audit logging are configured to match the approved flow authorizations.
- Encryption configuration, including FIPS-validated cryptography, is set up and verified against the client's own cryptographic module documentation.
- We run security testing on the enclave, including application, API and infrastructure checks, before handover.
How we hand over
- Documentation covers the system security plan inputs, network diagrams, data flow maps and configuration baselines for the enclave.
- Evidence packages are organized by practice so the client's assessor can trace each requirement to a configuration or log.
- Runbooks cover upgrades one major version at a time, backup and restore testing, and access reviews.
- Knowledge transfer sessions train the client's administrators to operate and maintain the enclave independently.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after handover.
- Retainers can cover monthly maintenance releases, configuration drift checks and periodic access and log reviews.
- We can re-test the enclave after material changes to the boundary, identity provider or hosting environment.
- Ask any partner which support tier, response commitments and upgrade schedule are included in the written quote.
