Almost every defense contractor stores CUI in someone else's cloud. Email, file storage, collaboration tools and backups usually run as cloud services, and each one that touches CUI raises the same question during a CMMC assessment: does this provider meet the bar?
The bar is FedRAMP Moderate, or something DoD accepts as equivalent. The rule is short, but it is widely misread. Teams assume a provider's commercial security reports are enough, or that a "FedRAMP" badge on a website covers the specific service they use. This article explains where the requirement comes from, what equivalency means, which services it reaches, and what to collect so your assessor can see it.
Where the cloud requirement comes from
The requirement predates CMMC. DFARS 252.204-7012 says that if a contractor uses an external cloud service provider to store, process or transmit covered defense information, the contractor must require and ensure that the provider meets security requirements equivalent to the FedRAMP Moderate baseline. The provider must also comply with the clause's paragraphs on cyber incident reporting, malicious software, media preservation, access for forensic analysis and damage assessment.
The CMMC program rule, 32 CFR Part 170, carries this into Level 2. A cloud service provider that processes, stores or transmits CUI for the organization being assessed must be FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency.
Note who carries the obligation: the contractor. Your provider has no contract with DoD. Your assessor will look to you for the evidence.
Two ways a cloud service qualifies
FedRAMP Moderate authorization
The simplest route is a cloud service offering that holds a FedRAMP authorization at Moderate or High, listed as "FedRAMP Authorized" on the FedRAMP Marketplace. A High authorization covers a stricter baseline, so it satisfies a Moderate requirement.
Read the listing carefully. Two Marketplace designations are not authorizations:
FedRAMP Ready means a third-party assessor found the service likely to achieve authorization. It is a readiness signal, not an authorization.
In Process means the provider is working toward authorization.
Authorization also applies to a specific cloud service offering, not to a vendor. Many providers run a commercial offering and a separate government offering. If your tenant is on the commercial one, the government offering's authorization does not cover it.
FedRAMP Moderate equivalency
The second route is equivalency: a service without a FedRAMP authorization that DoD will accept as meeting the same standard. The DoD CIO set out what that means in a memorandum on FedRAMP Moderate equivalency for cloud service offerings. In summary:
The provider must implement every control in the current FedRAMP Moderate baseline, with gaps remediated rather than left open on a plan of action.
The assessment must be performed by a FedRAMP-recognized 3PAO, the same kind of assessor used for FedRAMP itself.
The provider must produce a body of evidence comparable to a FedRAMP package: a System Security Plan, a security assessment plan and report, a POA&M and a customer responsibility matrix.
The provider must meet the DFARS 252.204-7012 obligations on incident reporting and forensic access, and maintain the controls over time.
Equivalency is not a lighter path. It is the same standard without the agency sponsorship or the FedRAMP listing.
When a provider tells you its service is "FedRAMP equivalent", ask three questions. Which 3PAO performed the assessment, and when? Will you provide the body of evidence, or a summary of it, to us and to our assessor? Are any baseline controls still open? Vague answers to any of these are a reason to treat the claim as unproven. Some providers will share the full package only under a nondisclosure agreement, which is reasonable. Refusing to share it at all leaves you unable to show your assessor what you relied on.
Which cloud services the requirement reaches
The test is whether the service stores, processes or transmits CUI. That usually includes:
email and messaging, if CUI is sent through them
file storage, collaboration and document management
engineering platforms, repositories and product lifecycle tools holding technical data
backup and archive services holding copies of any of the above
ticketing or support systems, if CUI ends up in tickets
Services that support security without handling CUI are treated differently. Under the CMMC rule, an external service provider that provides security functions but does not handle CUI is generally assessed as a Security Protection Asset within your own assessment, rather than needing FedRAMP authorization. Managed service providers that are not cloud service providers are also assessed as part of your environment. The boundary between these categories is where most disputes arise, so agree your interpretation with your assessor early.
This is why scoping comes first. A service you thought was out of scope becomes in scope the moment an engineer drops a CUI drawing into it. The method is in scoping where CUI lives in your environment.
Authorization covers the provider's side only
A FedRAMP authorization tells you the provider implemented its controls. It says nothing about how you configured your tenant, who you gave access to, or whether you turned on the logging the provider makes available.
Every authorized service has a customer responsibility matrix that lists which controls the provider fully implements, which are shared, and which are yours. Your SSP should reflect that split. For a shared control, describe your part: the MFA policy you enforce, the retention you set, the reviews you perform.
An assessor will test your side. Inheriting a control from an authorized provider is legitimate, but only for the portion the provider actually delivers.
DoD impact levels are a different question
You may see cloud services advertised at "IL4" or "IL5". These are impact levels from the DoD Cloud Computing Security Requirements Guide, administered by DISA, and they govern cloud services used by DoD itself. They are a separate authorization scheme from the FedRAMP Moderate requirement in DFARS 252.204-7012.
A service authorized at a DoD impact level will usually also hold a FedRAMP authorization, because the DoD levels build on FedRAMP baselines. But the contractor requirement is FedRAMP Moderate or equivalent. Check for that directly rather than inferring it.
What to collect from each provider
For every cloud service in your CUI scope, keep a file your assessor can review:
- Not done:
Evidence of status: the Marketplace listing for the specific offering, or the provider's equivalency body of evidence
- Not done:
The customer responsibility matrix for that offering
- Not done:
Contract terms covering DFARS 252.204-7012 incident reporting, media preservation and forensic access
- Not done:
Confirmation of which offering your tenant runs on
- Not done:
Your configuration evidence for each shared or customer control
- Not done:
A review date, so you notice if the provider's status changes
Treat this as part of vendor management, not a one-time collection. The vendor due diligence checklist covers the broader review, and the steps for subcontractors who receive CUI from a prime are in CMMC for subcontractors.
How TrustLynce helps
The third-party risk workflow keeps each cloud provider's authorization evidence, responsibility matrix and review date together, and flags when a reassessment is due. TrustLynce maps your customer responsibilities into the same NIST SP 800-171 controls your assessor tests. For the frameworks themselves, see our CMMC and FedRAMP pages.