ITAR-compliant file sharing and cloud storage for small shops
Published 2026-10-22
No cloud is "ITAR compliant" on its own. There is no ITAR certification for a product, and Microsoft says as much on its own ITAR page. What the regulation controls is who can see your technical data: a drawing that leaves the United States, or that a foreign person can open, may be an export under 22 CFR 120.50 and 120.56. When the same drawing arrives under a contract that carries DFARS 252.204-7012, the cloud holding it must also meet the FedRAMP Moderate baseline or its equivalent, and the encryption must be FIPS-validated SC.L2-3.13.11.
We read six services where a small machine shop can keep drawings and swap them with a prime, against both rules. If you are not sure a drawing is controlled at all, start with what ITAR compliance means for a manufacturer and the is it CUI? tool.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Sharetru Federal
The Marketplace lists it by name at Moderate, and its own pages answer every inside row: US data centers, US-citizen administrators, FIPS 140-3 modules and a record you can export.
Read the Sharetru Federal notesMicrosoft 365 GCC High
For a shop that will run everything in Microsoft: SharePoint and OneDrive in GCC High carry a FedRAMP High listing and sit in Microsoft's ITAR and DFARS scope, under an extra ITAR agreement.
Read the Microsoft 365 GCC High notesPreVeil Drive
It encrypts end to end beside the email and files you already use, the 22 CFR 120.54 route. Its FedRAMP Moderate equivalency is the vendor's claim, so ask for the evidence.
Read the PreVeil Drive notes
Two ways a cloud can hold ITAR drawings
The regulation leaves a shop two ways to put technical data in someone else's cloud without it becoming an export. Every service in this comparison takes one of them, and the route decides what you should ask the vendor to prove.
The data sits on servers in the United States and only US persons administer the system or reach the files. Nothing is transmitted out of the country and no foreign person sees it, so neither export a file share can cause under 120.50(a)(1) and (2) happens.
What to ask the vendor for
- US data centers, named in the contract
- US-person administrators and support
- A written commitment, not a brochure line
22 CFR 120.50(a)
Sending, taking or storing unclassified technical data is not an export if it is encrypted end to end with FIPS 140-2 (or successor) modules or at least AES-128 strength, is not intentionally sent to or stored in a country listed in 22 CFR 126.1, and is not sent from one.
What to ask the vendor for
- The provider never holds the means to decrypt
- FIPS-validated modules, or AES-128 strength or better
- Storage outside the 126.1 countries
22 CFR 120.54(a)(5)
End to end has a strict meaning here: the data is never unencrypted between the sender and the intended recipient, and the means of decryption are not given to any third party, the cloud provider included. A service that encrypts your files but keeps the keys on its own servers is on route 1, not route 2, and has to answer route 1's questions.
Both routes fail the same way, through a person. Handing someone the password or key that lets them open the unencrypted file is a release under 120.56(a)(3), and a release to a foreign person inside the United States counts as an export to every country where that person holds citizenship or permanent residency (120.50(b)). A US person, for this rule, is a US citizen or other protected individual, a green-card holder, or a company incorporated in the US (120.62). The cloud keeps the server side clean; who you invite to a folder stays your decision.
Which route fits your shop
Answer four questions about your data and your current tools. The shortlist below the questions comes from the same status words as the table, and each name jumps to that service's notes.
Four questions. The shortlist comes from the same table below, so it changes when the table does.
Shortlist: listed or claimed at FedRAMP Moderate or above
- Commercial Microsoft 365 is not on Microsoft's ITAR scope list. Either move to GCC High, or keep the controlled drawings in a separate service beside it.
- DFARS 7012 adds FedRAMP Moderate or its equivalent. A Marketplace listing is the simple proof; for an equivalency claim, ask for the body of evidence the DoD CIO memo of 2023-12-21 describes.
- For ITAR, pick a route: US-only storage with US-person staff (route 1), or end-to-end encryption where the provider never holds your keys (route 2).
- Sharetru Federal
- Kiteworks Federal Cloud
- PreVeil DriveFedRAMP equivalency is the vendor's claim
- FileCloud FedRAMP
- Box
- Microsoft 365 GCC High
A shortlist, not a ruling. Your contract and your export counsel decide.
Six services against the rule
Rows inside the boundary are what ITAR and DFARS 7012 ask of a place that stores controlled drawings. Rows outside it are conveniences your staff will notice first. Every word was read on the vendor's own pages or the FedRAMP Marketplace on 2026-10-22. If you are weighing a separate enclave instead, the CMMC enclave comparison covers that route.
| What the rule asks | Sharetru Federal | Kiteworks Federal Cloud | PreVeil Drive | FileCloud FedRAMP | Box | Microsoft 365 GCC High |
|---|---|---|---|---|---|---|
| Inside the boundary | ||||||
| FedRAMP Moderate or equivalent, for a cloud that holds CUIDFARS 252.204-7012(b)(2)(ii)(D) | Certified host (Moderate) | Certified (Moderate) | Vendor states equivalency | Certified host (High) | Certified (High) | Certified (High) |
| FIPS-validated encryption in transit and at rest3.13.11, with 3.13.8 and 3.13.16 | FIPS 140-3 stated | FIPS 140-3 stated | FIPS 140-3 stated | FIPS 140-3 stated | FIPS 140-2 stated | FIPS 140-2 stated |
| Administered and supported only by US persons22 CFR 120.50(b), 120.56(a) | US citizens stated | US citizens stated | Carve-out instead | Not stated | Escalations only | Support excluded |
| Data stored only in the United States22 CFR 120.50(a)(1); 120.54(a)(5)(iv) | US stated | Not stated | US stated | US stated | US stated | By ITAR agreement |
| Supports 72-hour incident reporting and 90-day image retentionDFARS 252.204-7012(c)–(g) | Stated | Not stated | 7012 (c)–(g) stated | 72 h not stated | Not stated | In DFARS scope list |
| Audit logs you can export3.3.1, 3.3.2 | Export stated | Export stated | Export not stated | Export stated | Export stated | GCC High not named |
| Outside the boundary | ||||||
| Desktop sync or mapped drive | Not stated | Not stated | Stated | Stated | Not stated | Not stated |
| Guest links that expire | Stated | Stated | Not stated | Stated | Stated | Not stated |
| Single sign-on for staff | Stated | Stated | Not stated | Stated | Stated | Stated |
| Integrations: email, SIEM, SFTP or API | Stated | Stated | Stated | Stated | Stated | Not stated |
What the words mean
- MeetsCertified host (Moderate)FIPS 140-3 statedUS citizens statedUS statedStatedExport statedCertified (Moderate)7012 (c)–(g) statedCertified host (High)Certified (High)FIPS 140-2 statedBy ITAR agreement
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialVendor states equivalencyCarve-out insteadExport not stated72 h not statedEscalations onlySupport excludedIn DFARS scope listGCC High not named
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot stated
- Not stated in what we read. Ask the vendor in writing before you rely on it.
Before the first drawing goes up
A listed service gives you a safe place. These six steps are what makes the shop's use of it defensible when a prime's questionnaire or an assessor asks. The full ITAR side is in the ITAR compliance checklist, and the incident clause is explained in DFARS 252.204-7012 explained.
- 01
Get the ITAR terms in writing
Microsoft asks GCC High customers to sign an additional agreement before they store ITAR data. Ask every other vendor for the same two promises in the contract: where the data is stored, and that only US persons can reach it.
- 02
Put the service in your SSP
Cite the FedRAMP Marketplace package ID and attach the vendor's customer responsibility matrix. The matrix tells you which requirements the vendor covers and which stay with you.
- 03
Make guest links expire and ask for sign-in
A link anyone can open is a release you cannot trace. Most services in the table state an expiry setting for guest links (the row outside the boundary); turn it on before the first share.
- 04
Know who your guests are
A prime's engineering team can include foreign persons. The license question is per person, so a folder shared with a whole outside team needs the same check as a new hire.
- 05
Keep the record long enough
Retention differs: Microsoft's standard audit keeps 180 days by default, Box keeps production logs at least a year, Sharetru keeps 12 months. Export what your own policy needs, on a schedule, not after an incident.
- 06
Have the 7012 reporting kit ready
A cyber incident goes to DoD within 72 hours through dibnet.dod.mil, which needs a medium assurance certificate, and the affected images are kept for at least 90 days. Buy the certificate before you need it.
Email is the other leak. A drawing that lives in a listed file share and then goes out as a plain attachment has left the boundary; send a link instead, or use a service from the CMMC- and ITAR-ready email comparison. For machine-to-machine transfers to a prime's portal, the ITAR-compliant file transfer comparison covers SFTP and managed file transfer. Once a job is in the ERP, its travelers and attached drawings sit there too; the ERP comparison for shops that hold CUI reads which systems can hold them.
The services, one by one
Sharetru Federal
What it is. A service for exchanging CUI and ITAR files: shared workspaces and links for people, SFTP and an API for systems. It runs inside the GovPoint Cloud Services FedRAMP Moderate package, where the Marketplace lists it by name.
Who it fits. A shop that swaps drawings with primes and subs every week and wants every guest to sign in with MFA and every open logged, without moving its email.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified host (Moderate) |
| Administered and supported only by US persons | US citizens stated |
| Audit logs you can export | Export stated |
Checked on sharetru.com, 2026-10-22
Kiteworks Federal Cloud
What it is. One platform for file sharing, SFTP, managed file transfer, secure email and web forms. Kiteworks Federal Cloud is FedRAMP Certified at Moderate; its Secure Gov Cloud in AWS GovCloud is listed as Agency Authorization In Process at High.
Who it fits. A shop that moves drawings over several channels, such as email, a portal and SFTP to a prime's system, and wants them under one log and one set of rules.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified (Moderate) |
| Administered and supported only by US persons | US citizens stated |
| Data stored only in the United States | Not stated |
Checked on kiteworks.com, 2026-10-22
Check with the vendor before you buy.
PreVeil Drive
What it is. Encrypted file storage and sharing that shows up as a drive in Windows File Explorer and Mac Finder, with encrypted email beside it. Files are encrypted on your device and PreVeil says it has no access to the keys; data subject to DFARS, CMMC or ITAR is stored in AWS GovCloud (US).
Who it fits. A shop on commercial Microsoft 365 or Google Workspace that wants ITAR drawings protected without moving the whole company to GCC High.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Vendor states equivalency |
| FIPS-validated encryption in transit and at rest | FIPS 140-3 stated |
| Administered and supported only by US persons | Carve-out instead |
Checked on preveil.com, 2026-10-22
Check with the vendor before you buy.
FileCloud FedRAMP
What it is. FileCloud's hosted service for federal and defense customers, built on AWS GovCloud and listed by name under the FedHIVE package at FedRAMP High. FileCloud also sells a server you host yourself, including on AWS GovCloud.
Who it fits. A shop that wants sync and a mapped drive that feel like its old file server, or one that would rather run the software in its own GovCloud account.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified host (High) |
| Administered and supported only by US persons | Not stated |
| Supports 72-hour incident reporting and 90-day image retention | 72 h not stated |
Checked on filecloud.com, 2026-10-22
Check with the vendor before you buy.
Box
What it is. Box's content platform, listed in the FedRAMP Marketplace at High (Class D). Box says customer data in that service is processed and stored in the United States; its trust page lists ITAR with the details provided under NDA.
Who it fits. A shop whose prime or agency customer already works in Box, and that wants the FedRAMP High service rather than a commercial account.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified (High) |
| Data stored only in the United States | US stated |
| Administered and supported only by US persons | Escalations only |
Checked on box.com, 2026-10-22
Check with the vendor before you buy.
Microsoft 365 GCC High
What it is. SharePoint Online and OneDrive in Microsoft's GCC High environment, built to DoD Impact Level 4 controls for contractors holding CUI or ITAR data. Microsoft validates eligibility before it sets up a tenant, and ITAR data needs an extra agreement with Microsoft.
Who it fits. A shop ready to move email, Teams and files together into one government tenant, usually through a Microsoft partner.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified (High) |
| Administered and supported only by US persons | Support excluded |
| Data stored only in the United States | By ITAR agreement |
Checked on learn.microsoft.com, 2026-10-22
Check with the vendor before you buy.
How we read the services
Questions shops ask about ITAR storage
Is any cloud storage ITAR certified?
No. The ITAR has no certification for products or services, and Microsoft says so on its own ITAR page. A vendor can design its service so that using it does not cause an export; whether your use stays inside the rule is still your program. Treat "ITAR certified" on a sales page as a reason to ask which route the vendor means.
Can I keep ITAR drawings in regular Microsoft 365 or Google Drive?
Not on route 1. Microsoft lists GCC High and DoD, not commercial Office 365, as the environments in scope for ITAR. A commercial account could only qualify on route 2, with files encrypted end to end before they reach the provider and keys the provider never holds, which is what add-on services such as PreVeil are built for. GCC vs GCC High shows which Microsoft cloud fits which data.
Does end-to-end encryption make FedRAMP unnecessary?
No. The encryption carve-out answers the ITAR question, whether storing the file is an export. DFARS 7012 asks a different one: any cloud that holds covered defense information must meet the FedRAMP Moderate baseline or its equivalent. For a provider that is not authorized, the DoD CIO memo of 2023-12-21 asks for 100 percent of the Moderate baseline, assessed by a FedRAMP-recognized 3PAO, with the body of evidence handed to you. The test is in FedRAMP Moderate equivalency explained.
What is the difference between FIPS validated and FIPS compliant?
Validated means the Cryptographic Module Validation Program (CMVP) validated the module itself. Compliant is an industry term for a product that relies on a validated module somewhere inside it. Requirement 3.13.11 asks for FIPS-validated cryptography, so ask the vendor for the module's certificate number, not the word.
Can an employee who is not a US person use the shared drive?
Not the ITAR folders, unless DDTC has authorized the release, for example by a license. Showing them the file, or giving them the password or key that opens it, is a release, and a release to a foreign person in the United States is an export to every country where they hold citizenship or permanent residency. Folder permissions are how you keep the rest of the drive open to them.
Does the CMMC suspension change any of this?
No. ITAR is the State Department's rule and the CMMC suspension does not touch it. On the defense side, the suspension stops contracts adding third-party assessments, while DFARS 252.204-7012, its FedRAMP requirement for cloud and NIST SP 800-171 Rev 2 still apply. What still applies today.