Why self-hosted file sharing for the public sector starts with jurisdiction and evidence
For a government agency replacing US hyperscaler storage, the working answer is a self-hosted Nextcloud or Seafile deployment inside agency-controlled infrastructure, or the openDesk packaged suite, with a supported edition selected before go-live. The data an agency holds may include controlled unclassified information (CUI), criminal justice information (CJI) and citizen records, and each class brings its own control set and its own audit trail. Before any platform is compared, the agency should decide which data classes will live on the platform, because that decision sets the hosting boundary, the security baseline and the evidence the agency must produce later.
The platform choice matters less than three other decisions. The first is the hosting boundary: which data centers, cloud accounts and administrators can reach the stored files, and whether any cloud service sits in the assessment scope. The second is the authentication source, meaning which directory or identity provider is authoritative for users, groups and deprovisioning. Nextcloud documents LDAP and Active Directory login, as well as OpenID Connect and SAML backends, so the agency must confirm which one it will use and who owns it. The third is the records process: how versions, deletions, legal holds and retention periods are set, and who signs off on them. Confirm these with your records officer and your assessor before the platform is configured.
DeployOpen plans, implements, hardens and documents self-hosted platforms inside the agency's own infrastructure, and it prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications, and those decisions rest with the agency's independent auditors or the relevant authorizing body. Ask any implementation partner to show how it would produce the evidence an assessor will request, including configuration baselines, access reviews and audit logs, and to state in writing which parts of the evidence remain the agency's responsibility.
Which public sector obligations shape the file sharing build
This table maps each public sector obligation that applies to agency or contractor file sharing to what it means for the design, hosting and evidence of a self-hosted build. Read each row against your agency's authorization boundary and data classification, since the same platform can fall in or out of scope depending on who uses it and what information it holds.
| Obligation | What it means for the build | Confirm with |
|---|---|---|
| NIST SP 800-53 baselines (low 149, moderate 287, high 370 controls) | Select the baseline matching the highest impact level of data the share will hold, then tailor it. Plan control evidence per enhancement, not per product, so Nextcloud settings, OS hardening and backups each map to named controls. | Authorizing official and system security plan owner |
| FISMA and Inspector General assessment | Expect the system to be assessed independently and reported up to OMB. Keep configuration baselines, change records and audit logs in a form an outside reviewer can sample without rebuilding the environment. | Agency CISO and Inspector General liaison |
| FedRAMP scope under M-24-15 | A self-hosted instance run only for one agency's operations on that agency's own infrastructure is generally outside FedRAMP scope. Hosting on a cloud provider as a shared service for other customers may bring it in, so confirm the boundary before choosing a hosting model. | Agency authorizing official and FedRAMP program office guidance |
| CJIS Security Policy v6.1 encryption and scanning | For criminal justice information, use FIPS 140-3 validated modules or AES with keys of at least 256 bits for data in transit and at rest outside physically secure locations. Schedule vulnerability scans at least monthly and retain the results as evidence. | CJIS Systems Agency and the version 6.1 Requirements Companion Document |
| 32 CFR 2002.14(h)(2) and NIST SP 800-171 for CUI | When an agency sets requirements for CUI on non-federal systems, NIST SP 800-171 is the default unless the CUI category prescribes other safeguards. Contractor-hosted shares need the same controls, and the agreement should name which set applies. | Agency CUI program office and contracting officer |
| CMMC cloud rule for defense contractors | Under 32 CFR 170.17(c)(5), storing CUI in a cloud service requires FedRAMP Authorized at the Moderate baseline or higher, or equivalent. A self-hosted Nextcloud in the contractor's own boundary keeps the hosting decision inside the assessment scope, so document that boundary precisely. | C3PAO or assessor and the contractor's scoping documents |
| ADA Title II WCAG 2.1 Level A and AA | Web content and mobile apps that the entity provides, including through contracts or licenses, must meet WCAG 2.1 A and AA from 26 April 2027 for entities serving 50,000 or more people, and from 26 April 2028 for smaller entities and special districts (28 CFR 35.200). Test the sync client, web UI and any bundled office editor, and include accessibility terms in the procurement. | Agency ADA coordinator and accessibility testing team |
| NIS2 scope and national security exclusion | NIS2 lists public administration as a high-criticality sector and covers central government entities regardless of size, with Member States free to extend it to local administration. It excludes national security, public security, defense and law enforcement, so confirm whether the file share falls in scope before adopting NIS2 controls as the baseline. | National NIS2 transposition authority and agency legal counsel |
Choosing between an agency tenant, a shared government service and a SaaS offering
An agency-operated Nextcloud runs in agency data centers or in cloud infrastructure the agency controls for its own use. The agency owns the servers, the database, the backups and the administrators, so the hosting boundary is drawn around its own environment. Because the platform serves a single agency and is not offered to other customers, the agency carries the authorization and assessment work itself, and the scope of that work is set by its own system boundary.
- Full control of data location: Files, database and backups stay in facilities the agency selects, which simplifies answers to data residency questions.
- Self-owned evidence: Access logs, change records, patch history and backup restore tests are produced by the agency's own teams and must be retained by them.
- Recurring staff cost: Patching, upgrades one major version at a time and on-call support fall to the agency's platform team or a partner under a written scope.
- Accreditation burden stays local: The agency must document its security plan and controls against the baseline its authorizing body requires.
- Cloud infrastructure still needs review: If the agency uses a commercial cloud account, it must confirm how that provider's services are authorized for the data involved.
Before committing, confirm with your authorizing official and CISO which baseline and authorization path applies to your data classes.
A shared government-run instance is operated by a central public body and offered to several agencies or departments on common terms. The hosting boundary now includes the shared operator, so tenants inherit some controls and evidence from the operator while retaining responsibility for their own configuration, identity and data handling. Whether the service falls under federal cloud authorization depends on whether it is offered as a shared service, which is the central question for scope.
- Shared control inheritance: Common controls, such as physical security and platform patching, can be documented once by the operator and referenced by each tenant.
- Tenant responsibilities remain: Each agency still owns its user lifecycle, sharing rules, retention settings and records decisions.
- Service terms matter: Obligations such as incident notification, log access and exit support must be written into the service agreement.
- Scope changes with offering model: Once a service is offered to several customers, federal cloud authorization rules are more likely to apply.
- Data separation between tenants: Confirm how tenant isolation, encryption keys and administrator access are separated.
Ask the operator for its current authorization status and the written inheritance matrix, and confirm both with the relevant authority.
A vendor-hosted cloud offering is run by a commercial provider on its own infrastructure and sold to the agency as a subscription. The agency's hosting boundary covers its identity integration, its configuration and the data it uploads, while the provider owns the platform, the infrastructure and most operational evidence. FedRAMP scope applies here because the provider creates, stores and processes federal information on behalf of agencies and offers the service to multiple customers.
- Authorization is provider-specific: The agency needs evidence that the exact offering, not just the provider's company, holds the authorization level its data requires.
- Evidence comes from the provider: Agencies rely on the provider's security package, continuous monitoring reports and audit artifacts, which must be requested and reviewed.
- Data location and key control: Confirm where data, backups and encryption keys reside and who can access them under legal demand.
- Exit and portability: Export formats, deletion certificates and transition support should be written into the contract.
- Subscription cost recurs: Pricing scales with users and storage over the contract term, which should be compared with the staffing cost of self-operation.
Confirm the offering's current authorization status and its impact level directly with the authorizing body before you rely on it.
Which platforms fit public sector file sharing and why
Public sector agencies usually choose between a full-featured sync and share platform, a lighter sync-focused tool, or a packaged government workplace suite. The cards below set out where each fits, what it commits you to operationally, and the question to settle before procurement.
Nextcloud Server
Nextcloud Server is licensed under AGPL-3.0, so an agency can run the community code on its own infrastructure without per-user license fees. Commercial support comes from Nextcloud Enterprise in Standard, Premium and Ultimate tiers, with a 100-user minimum. The operational commitment is upgrades: Nextcloud does not allow skipping major releases, so each upgrade is one major version at a time, with a backup first. Confirm which support tier and maintenance lifecycle your procurement rules require.
Seafile for sync-focused needs
Seafile is released under GPLv2 with an additional permission to link with OpenSSL, and it focuses on file sync and share rather than a broad collaboration suite. It suits agencies that need reliable library sync and sharing, and that will run office editing, chat and calendars elsewhere. Check whether its directory integration, audit logging and external sharing controls meet your identity and records requirements, since these are the areas where the feature set differs most from Nextcloud. Confirm the supported edition and support terms before you commit.
openDesk as a packaged option
openDesk is a Kubernetes-based digital workplace suite for public administration, provided by ZenDiS GmbH, and it bundles Nextcloud for files alongside other workplace components under one identity layer. Its deployment automation is Apache-2.0, but each bundled component keeps its own license, such as AGPL-3.0 for Nextcloud and GPL-3.0 for OpenProject. ZenDiS recommends openDesk Enterprise Edition for production, so ask whether the SLA-backed support and closed-source modules are acceptable to your security team. Confirm your Kubernetes platform meets the stated requirements before planning.
ONLYOFFICE for browser editing
ONLYOFFICE Docs is an online office suite compatible with Office Open XML formats and licensed under AGPL-3.0. It fits agencies whose staff exchange Word, Excel and PowerPoint files and need in-browser co-authoring tied to a sharing platform. Because it is a separate service, it adds its own patching and certificate duties and must be connected to the file platform securely. Confirm how its licensing applies to your deployment and which editions include the features your agency needs.
Collabora Online for web office
Collabora Online is licensed under the Mozilla Public License 2.0, a file-level copyleft license that many procurement teams review differently from AGPL. It is the web office component in openDesk, so agencies already planning that suite may find it familiar. Like ONLYOFFICE, it runs as a separate service that needs its own sizing, patching and integration testing. Confirm the license obligations with your legal team, and check which document formats and macro behavior your staff require before choosing between the two editors.
Integration points that agencies must design before go-live
Most of the risk in a public sector file sharing rollout sits at the edges of the platform: the directory, the proxy, the database, the backups and the records schedule. Each card below is a decision an agency should settle in writing before users arrive, because later changes touch every other component.
Directory and single sign-on
Nextcloud's LDAP app lets Active Directory users appear in Nextcloud and sign in with directory credentials, and OpenID Connect and SAML backends are also documented. Agencies should decide which one is the system of record for accounts, groups and deprovisioning, since a leaver who stays active in the file platform is a finding. Confirm how group membership maps to shares and quotas, and test a disabled account end to end.
Reverse proxy and internal certificate authority
Nextcloud runs behind Apache 2.4 or nginx with php-fpm, and clients, browsers and the office editing server all need to trust the same TLS chain. Agencies typically issue certificates from an internal certificate authority, so the root must be distributed to desktop and mobile sync clients through managed devices. Document the certificate renewal owner, the cipher policy and how the proxy forwards client addresses to the audit log.
Database and cache selection
Nextcloud 35 recommends MariaDB 11.8 or PostgreSQL 18, with MariaDB 10.11 to 12.3, PostgreSQL 14 to 18 and MySQL 8.4 or 9.7 also supported. Oracle is available only with an enterprise subscription. Choose one engine from the supported list, confirm the database version against the release in use, and plan Redis caching and a single owner for database patching and backups.
External services that openDesk expects
An openDesk production design depends on services the platform does not provide itself: PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV over ICAP, object storage and a TURN server. If the agency adopts openDesk, each of these needs an owner, a hosting location inside the approved boundary and a version plan. Confirm the exact list against the current requirements before procurement.
Backup and restore targets
Nextcloud requires a backup before every upgrade, and that backup must include both the database and the data directory, which must stay consistent with each other. Agencies should define recovery point and recovery time targets with the records owner, store copies in a separate administrative domain and rehearse a full restore on a schedule. Ask any partner to show a restore test log, not just a backup job.
Records retention and the agency schedule
A file sharing platform is not a records system unless retention is configured to match the agency records schedule. Map each folder class to a retention period, decide whether versions and trash bin entries count as records, and confirm how legal holds suspend deletion. Federal rules on broker-dealer communications and health information audit controls show how regulators expect retention and activity logs to be provable, so ask the records officer to approve the mapping before go-live.
How a public sector rollout moves from assessment to supported operation
This sequence takes an agency from a signed scope and data classification through hosting, identity, migration and records setup to cutover and a supported operating model. Each phase closes with a written artifact that the security office and program owners can review before the next phase starts.
Agree scope and classify data with the security office
The agency's security office, records officer and program owners define which teams, file types and data categories move onto the platform, and which stay where they are. DeployOpen documents the data classes, expected user counts, external sharing needs and any controlled categories that change the control baseline. The phase closes with a signed scope document and a data classification register that name the systems in scope and the owners of each dataset.
Decide hosting, jurisdiction and authority to operate
The agency chooses where the platform runs, such as its own data center, a government cloud account or an air-gapped network, and who holds administrative keys. Where the data involves federal cloud services, the team confirms whether FedRAMP scope applies and which NIST SP 800-53 baseline the authorizing official expects. The phase closes with a written hosting decision and a boundary diagram that the authorizing body can review.
Integrate identity and run a controlled pilot
DeployOpen connects the platform to the agency's existing directory through LDAP or Active Directory, or to an OpenID Connect or SAML identity provider, and maps groups to roles. A small pilot group of named users tests login, sync clients, external guest access and access removal when someone leaves. The phase closes with pilot results that list defects, their fixes and the user groups approved for wider onboarding.
Configure and harden to the chosen baseline
Engineers build the production environment, set encryption, audit logging, antivirus scanning, sharing restrictions and session rules, and map each setting to the control families selected in the scope. Third-party apps are reviewed and limited to those the agency approves. The phase closes with a configuration baseline and a control mapping that the security office signs off, along with evidence that the settings are active.
Migrate shares and cloud drives in waves
Existing file servers and cloud drives are inventoried, then moved in waves by department, with permissions rebuilt from the source systems rather than copied blindly. Each wave is checked for file counts, checksums where the source supports them, and permission accuracy against the owner's sign-off. The phase closes with a migration report per wave listing moved data, exceptions and retired sources.
Set records, retention and accessibility checks
The records officer defines retention periods, legal holds and deletion rules, and DeployOpen configures versioning, trash retention and any records-related settings the platform supports. The public-facing and staff-facing interfaces are tested against WCAG 2.1 Level A and AA with assistive technology, and defects are logged and assigned. The phase closes with a retention schedule, configured rules, and an accessibility test report that lists open issues and their owners.
Cut over and verify operations
Users are moved to the new platform on an agreed date, with a rollback path, a freeze on the legacy shares, and a support contact for the first weeks. Backups, restore tests and monitoring are verified against the recovery targets the agency set during scoping. The phase closes with a cutover record, a restore test result and a go-live sign-off from the program owner.
Hand over to a supported operating model
The team delivers runbooks, the evidence pack for assessors, upgrade procedures and the support tier the agency selected. Upgrades follow the vendor's one-major-version-at-a-time path, and the support contract defines response expectations in writing. The phase closes with a handover acceptance document and a named operations owner inside the agency.
How upgrade cadence and support tiers affect long-term agency operations
Nextcloud does not allow skipped major releases, so an agency running an older major version must step through each intermediate major in order, one at a time. Every step needs a backup taken beforehand and a check that each third-party app is confirmed compatible before the app is re-enabled. Plan this as a recurring operating task, not a one-off project. Nextcloud 33 is supported until February 2027, Nextcloud 34 until June 2027 and Nextcloud 35 until September 2027, so an agency that installs 33 today will need to move to a later major version within months. Confirm your own upgrade calendar against the maintenance schedule and reserve change windows and test environments for each step.
openDesk does not guarantee in-place upgrades between major releases, and only the latest minor version is supported. ZenDiS plans major releases annually in Q3 and minor releases monthly, so an agency that falls behind may need intermediate steps before reaching a supported state. Ask your partner how the deployment repository and Helmfile configuration will be versioned, how bundled components such as Nextcloud, OpenProject and Collabora are pinned, and whether the upgrade path is tested in a staging cluster before production. Clarify who performs each step and who signs off the post-upgrade evidence.
Support tier is a procurement decision with operational consequences. The published Nextcloud Enterprise tiers differ mainly in maintenance lifecycle and response commitments. Standard includes one year of maintenance. Premium adds a maintenance lifecycle of five or more years, extended support hours and clustered instance support. Ultimate adds support up to 24/7 with response times down to one hour. For openDesk, ZenDiS recommends Enterprise Edition for production, with SLA-backed second and third level support. Confirm with your procurement office which tier and lifecycle commitment the agency requires, and whether the contract covers the components your partner deploys, not only the core server.
What auditors and oversight bodies ask to see from the file sharing platform
This table maps each evidence area an assessor or oversight body typically requests to the platform component or process that produces it. Read it as a checklist for the design phase: if a row has no owner or no retained output, the assessment will likely stall. DeployOpen prepares this evidence, while independent auditors and certification bodies assess it.
| Evidence area | What the reviewer expects to see | Component or process that produces it |
|---|---|---|
| Access control records and directory mapping | Who can log in, how directory groups map to Nextcloud roles and shares, and proof that leavers lose access | Directory connector (LDAP, Active Directory, OpenID Connect or SAML), group mapping export, access review records |
| Encryption configuration evidence | Cipher and key lengths for data in transit and at rest, with FIPS 140-3 validated modules where CJI is stored outside physically secure locations | TLS configuration on the reverse proxy, server-side encryption settings, key storage and custody records, AES key length configuration |
| Audit logs and retention | Records of file access, sharing changes and admin actions, kept for the period the agency's records schedule requires | Nextcloud audit logging, forwarding to a central log store, retention settings and tested log export |
| Vulnerability scan records | Scan reports at least monthly for systems handling CJI, with findings triaged and closed or accepted in writing | Scheduled scanner runs against the Nextcloud host, database and web stack, remediation tickets and risk acceptance log |
| Change and upgrade records | Evidence that each major version was applied in sequence, with backup and third-party app compatibility checks before each step | Change tickets, upgrade logs from one major version to the next, app inventory before and after, test environment sign-off |
| Backup and restore test results | Dated restore tests showing files, permissions and the database can be recovered within the agency's stated targets | Backup jobs with retention settings, restore test runbooks, signed test reports and any gaps logged for remediation |
| Accessibility conformance reports | Evidence against WCAG 2.1 Level A and AA for web content and apps the agency provides, including those supplied under contract | Accessibility test results for the web interface and clients, remediation backlog, and conformance statement prepared for the agency |
What agencies ask before hiring a partner for self-hosted file sharing
What drives the cost of self-hosted file sharing for an agency?
Cost splits into one-time work and recurring spend. One-time items include scoping, installation, directory integration, migration from existing shares or cloud drives, hardening and documentation. Recurring items include storage, servers or cluster capacity, backups, staff time to administer the platform, and a support subscription if you buy one. Storage volume and user count move the largest line items. If you choose Nextcloud Enterprise, the Nextcloud pricing page lists per-user annual list prices starting at 71.29 euros for Standard, 104.99 euros for Premium and 204.75 euros for Ultimate, for 100 or more users, with a 100-user minimum and lower rates from 200 users. Ask any partner for a quote built from a written scope, and ask them to separate license, hosting, labor and recurring support.
How long does a self-hosted file sharing rollout take?
Duration depends on the number of users, the number and size of existing file stores, how many identity sources must be integrated, whether accreditation or compliance evidence is required, and how many sync clients need to be rolled out. Migration from Windows shares or cloud drives usually takes the most time because permissions must be mapped and verified. Upgrades also shape the schedule: Nextcloud requires one major version at a time, so a plan should account for that path after go-live. Ask the partner for a phased plan with milestones, acceptance criteria and a written timeline tied to the agreed scope rather than a generic estimate.
What does agency staff need to provide for the project?
Agency staff typically provide the following:
- A named sponsor and a product owner who can approve access rules and retention decisions.
- Access to the directory service, such as Active Directory or an OpenID Connect or SAML provider, and the group structure that maps to file permissions.
- An inventory of current file shares, cloud drives and their owners, plus data classification and retention requirements.
- Hosting capacity or approved cloud accounts, network paths, certificates and a decision on data location.
- Security and records staff to review the hardening baseline, backup targets and restore tests.
Ask the partner to list these inputs in the statement of work so that delays can be traced to a specific dependency.
Can an agency run self-hosted file sharing without a partner?
Yes, an agency with a capable infrastructure team can install and operate Nextcloud or Seafile in-house, and the software licenses are open source. The harder parts are sustained: keeping the platform on supported releases, applying security fixes on schedule, performing one-major-version upgrades with backups and compatibility checks, and producing evidence for assessments. The Nextcloud release schedule supports each major version for one year, so staff must plan upgrades continuously. Many agencies combine internal ownership with a partner for the initial build, integration and documentation, then keep the operating model they can staff. Confirm your internal skills before deciding.
Should an agency choose openDesk or Nextcloud?
Choose Nextcloud when the agency needs file sync and share as a standalone service that fits into existing identity, storage and office tools. Choose openDesk when the agency wants a packaged digital workplace that covers files, office, mail, chat, video, wiki and projects under one identity layer. openDesk is a Kubernetes-based suite provided by ZenDiS GmbH, and it bundles Nextcloud for files. Its requirements are heavier: a CNCF-certified Kubernetes cluster at v1.33 or later, cert-manager, an ingress controller, and external production services such as PostgreSQL, Redis and an SMTP relay. ZenDiS recommends openDesk Enterprise Edition for production. Test both against your skills and infrastructure before choosing.
How do FedRAMP or CJIS requirements change a file sharing project?
Scope decides which obligations apply. FedRAMP covers cloud products that handle federal information on behalf of an agency, and systems used only for a single agency's operations on cloud infrastructure are out of scope under OMB memo M-24-15. A self-hosted platform inside the agency's own data center avoids that cloud question but still must meet NIST SP 800-53 controls selected by the agency's baseline. For criminal justice information, the FBI CJIS Security Policy version 6.1 took effect on 26 June 2026 and requires FIPS 140-3 certified modules or FIPS 197 AES with at least 256-bit keys for CJI in transit and at rest outside physically secure locations, plus vulnerability scanning at least monthly. Ask the partner to map encryption, scanning and audit logging to the applicable control IDs before design begins.
What does Nextcloud Enterprise add beyond the community edition?
Nextcloud Enterprise adds paid support, maintenance and patch lifecycles on top of the AGPL-3.0 community code. The Nextcloud pricing page describes Standard as including one year of maintenance, Premium adding a maintenance lifecycle of five or more years, extended support hours and clustered instance support, and Ultimate adding support up to 24/7 with response times down to one hour. Enterprise sits alongside the community edition and is aimed at enterprise and public sector users. Ask whether you need a tier for the required support hours, and confirm which lifecycle matches your agency's accreditation cycle. Ask the partner whether they support Enterprise and how they handle the subscription in the quote.
What to ask an implementation partner before signing a fixed scope
Ask the partner to show, in writing, how each control in the agency's chosen baseline maps to a configured setting, a named owner and a piece of evidence. For a federal-style program, the baseline is usually a subset of the controls in NIST SP 800-53 Rev. 5 (Release 5.2.0 is the current release), and SP 800-53B defines low, moderate and high baselines of 149, 287 and 370 controls and enhancements. Ask whether the partner works from the OSCAL baseline profiles, which control items are inherited from the hosting environment, and which ones the partner configures in Nextcloud or openDesk. A partner who cannot produce that mapping before the statement of work is signed has not yet scoped the work.
Ask how directory integration will work with the agency identity source. Nextcloud's LDAP app can present Active Directory users inside Nextcloud, and OpenID Connect and SAML backends are documented, but the choice affects who can disable an account, how group membership maps to share permissions and where login events are recorded. For openDesk, ask how the Nubus identity layer and external IdP federation are configured and who approves changes. Ask for a written plan for one-major-version upgrades, since Nextcloud does not allow skipping major releases, and ask how the partner will test third-party apps before each step. Confirm the support tier in writing, including the response times and hours, and whether ZenDiS Enterprise Edition support is included for openDesk. Ask which of these are in the fixed scope and which are a retainer.
Ask who holds administrative credentials, how they are issued, rotated and revoked, and whether privileged sessions are recorded and reviewed by the agency. Ask how CUI or CJI scope is decided: which data categories enter the system, whether CJI under the CJIS Security Policy requires FIPS 140-3 validated modules in the design, and whether the partner's own staff with access to the environment fall under the agency's personnel screening. Finally, ask for the evidence package: configuration baselines, vulnerability scan records (CJIS v6.1 expects scanning at least monthly), backup and restore test reports, and audit log samples. Confirm that the partner prepares this evidence for an independent assessor but does not issue the assessment itself.
