Skip to content
FORGEPOINT CYBER
MENU
Schedule a readiness conversation (opens Microsoft Teams booking in a new tab)

Free tool · about 3 minutes

Can your cloud services hold CUI? Check each one.

Any cloud service that stores, processes or transmits controlled unclassified information (CUI) must meet security requirements equivalent to the FedRAMP Moderate baseline under DFARS 252.204-7012, on every platform. List your services, say what each holds, and see what the rule asks of it.

Your answers stay in your browser. Nothing is sent unless you ask for the full result and the PDF, and service nicknames never are.

Where do your email, files and user accounts live?

Your cloud services

Add each cloud service you use, including the ones your MSP runs for you. A nickname is optional; it stays in this browser tab and your PDF.

  1. What does it hold?

Not sure of a provider's FedRAMP status? Search the FedRAMP Marketplace. Your answers stay in this browser tab; nothing is sent unless you ask for the full result.

The rules behind the check · as of Nov 5, 2026

What DFARS 7012 and the CMMC rule say about cloud providers

In plain words. The check uses only these rules.
  • DFARS 252.204-7012 says that if you use an external cloud service provider to store, process or transmit covered defense information, you must require and ensure it meets security requirements equivalent to the FedRAMP Moderate baseline, and that it complies with the clause's paragraphs (c) to (g): cyber incident reporting, malicious software, media preservation and protection, access for forensic analysis, and damage assessment.
  • A cloud service provider that processes, stores or transmits CUI must meet the FedRAMP requirements in DFARS 252.204-7012.
  • A provider that handles only Security Protection Data (for example log files, configuration data, vulnerability status or passwords that grant access to the environment): its services are in your assessment scope and are assessed as Security Protection Assets.
  • A provider that handles neither CUI nor Security Protection Data doesn't meet the CMMC definition of an external service provider.
  • Each provider relationship and its services must be documented in your SSP and described in the provider's service description and customer responsibility matrix, which sets out who is responsible for what.

Questions

Cloud providers, FedRAMP and CMMC, answered

Does my cloud provider need to be FedRAMP authorized for CUI?

DFARS 252.204-7012 requires that a cloud service provider storing, processing or transmitting covered defense information meets security requirements equivalent to the FedRAMP Moderate baseline, and complies with the clause's incident reporting and related paragraphs (c) to (g). A FedRAMP Marketplace listing is the simplest evidence to keep; otherwise you need the provider's evidence of equivalency. The clause puts the duty on you, the contractor, to require and ensure it.

What about providers that only see our logs or settings?

Under the CMMC rule, a provider that handles only Security Protection Data, such as log files, configuration data, vulnerability status or passwords that grant access to your environment, isn't held to the FedRAMP requirement, but its services are in your assessment scope and are assessed as Security Protection Assets.

Is a provider that never touches CUI or security data in scope?

No. The rule says a service provider that doesn't process CUI or Security Protection Data doesn't meet the CMMC definition of an external service provider.

What do we need to document?

Each provider relationship and the services it provides must be documented in your System Security Plan (SSP) and described in the provider's service description and customer responsibility matrix, which sets out who is responsible for what.

Does this check verify my provider's FedRAMP status?

No. It applies the rules to your answers. Look up the provider and the exact service on the FedRAMP Marketplace, or ask the provider for its evidence, and keep what you find. The check isn't legal advice, an assessment or an SPRS score.

What happens to my answers?

They stay in your browser tab. Service nicknames are never sent to us: they appear only on your screen and in your PDF. If you ask for the full result, ForgePoint keeps your name, work email, company, platform, the suggested next step and the date in its CRM, and the PDF is drawn on request and not kept.

Where it leads

Level 2 Readiness Assessment

The Assessment confirms your boundary, including every provider in it and what each is responsible for, then checks all 110 requirements. See the Level 2 Readiness Assessment →