ITAR-compliant file transfer for primes and suppliers
Published 2026-10-22
A full CAD model and its drawing package rarely fit in an email, so most shops end up with an SFTP server, a prime's portal or a transfer service. The rules care about three things on that path. The connection must be encrypted SC.L2-3.13.8 with FIPS-validated cryptography SC.L2-3.13.11. Any cloud that holds the files on the way must meet the FedRAMP Moderate baseline or its equivalent under DFARS 252.204-7012. And under ITAR, sending technical data abroad or letting a foreign person open it is an export, whatever the protocol.
No transfer product is "ITAR certified", because the ITAR certifies no product. We read 4 services that give primes and suppliers an SFTP endpoint, against both rules. If the files are for people to open and edit rather than for systems to drop, read the ITAR-compliant file sharing comparison instead.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Sharetru Federal
Listed by name at Moderate, run by US-citizen staff, and built to replace an office SFTP server: SSH-key service accounts, five protocols and a log you can export, while your own scheduler keeps the jobs.
Read the Sharetru Federal notesKiteworks Federal Cloud
Certified at Moderate in its own right, with a hosted MFT engine that schedules, polls and triggers transfers, and SFTP, email and sharing under one log.
Read the Kiteworks Federal Cloud notesAWS Transfer Family (GovCloud)
Inside a FedRAMP High package and operated by US citizens, but it is a building block: you choose the FIPS policy, wire the logs and own the setup.
Read the AWS Transfer Family (GovCloud) notes
Three places a transfer can run
Before comparing products, decide whose system the file passes through. The rules ask different things of each, and the answer is often a mix: you push inspection reports to a prime's server and take drawings from suppliers on your own.
| Question | A transfer service | Your own server | The prime's portal or server |
|---|---|---|---|
| Where the files sit | On the provider's servers, in its cloud | On a machine you run, in the office or your own cloud account | On the prime's system; on your laptop or job server once fetched |
| The FedRAMP question | Yes: FedRAMP Moderate or equivalent, under DFARS 7012 | Not for the software itself; for any cloud it runs in | The prime's to answer, not yours |
| Who patches the server | The provider | You, on your own schedule | The prime |
| What goes in your SSP | The Marketplace package ID and the provider's customer responsibility matrix | The server as a CUI asset: inventory, network diagram, all 110 requirements | The connection as an external system (3.1.20), and the machine that fetches |
| Usually fits | Many partners, no IT staff, an old server to retire | A shop with an IT provider who already runs its CUI systems | A prime that tells you how it wants to receive |
Running your own server keeps the FedRAMP question away, but not the work. A machine that stores or transmits CUI is a CUI asset under 32 CFR 170.19, assessed against every Level 2 requirement, and flaw remediation SI.L2-3.14.1 is a 5-point item on your score. The CMMC scoping worksheet helps you put the server, the job box and the laptops that fetch files on the right side of the line.
Map your exchanges
List every partner you swap files with and how. Each row shows what that exchange puts on you, with the rule behind it. Print the result: it is the first draft of the data-flow part of your system security plan.
ITAR exchange register, cuideck.com
Edit any row. Pre-filled with a realistic example shop.
Example only- exchanges
- 4
- exchanges
- job account to name
- 1
- job account to name
- cloud to prove
- 1
- cloud to prove
- exchange to check
- 1
- exchange to check
- Exchange 01
- Their system answers the cloud question. Yours: the account you sign in with and the machine the file lands on. 3.1.20
- The person signs in with multifactor authentication. 3.5.3
- Exchange 02
- Their server answers the cloud question. Yours: the job box that pushes, its key and the record of what it sent. 3.1.20; 3.3.1
- Give the job its own account and key, so every file in the log traces to one job, not a shared login. 3.5.2; 3.3.2
- Exchange 03
- The service must be FedRAMP Moderate or equivalent; put its package ID and responsibility matrix in your SSP. DFARS 252.204-7012(b)(2)(ii)(D); 32 CFR 170.16(c)(2)
- The person signs in with multifactor authentication. 3.5.3
- If the files are covered defense information, the subcontract carries DFARS 7012 too. DFARS 252.204-7012(m)
- Exchange 04
- CheckAn attachment needs encryption in transit with FIPS-validated cryptography, and its trail lives in mailboxes, not in one transfer log. 3.13.8; 3.13.11
- The person signs in with multifactor authentication. 3.5.3
- If the files are covered defense information, the subcontract carries DFARS 7012 too. DFARS 252.204-7012(m)
- CheckAsk who will open the files. A release to a foreign person in the US is an export too. 22 CFR 120.50(b)
- This register is the start of your record of where CUI flows. If you are registered with DDTC, records of technical data sent are kept for five years from the transaction or the license's expiry. 3.1.3; 22 CFR 122.5(a)
Transfer services against the rule
Rows inside the boundary are what ITAR and DFARS 7012 ask of a service that holds controlled files on the way. Rows outside it are what your scripts and partners will need. Every word was read on the vendor's own pages or the FedRAMP Marketplace on 2026-10-22; vendors that also appear in our file sharing comparison carry the same words there.
| What the rule asks | Sharetru Federal | Kiteworks Federal Cloud | AWS Transfer Family (GovCloud) | Progress MOVEit Cloud |
|---|---|---|---|---|
| Inside the boundary | ||||
| FedRAMP Moderate or equivalent, for a cloud that holds CUIDFARS 252.204-7012(b)(2)(ii)(D) | Certified host (Moderate) | Certified (Moderate) | Certified (High) | Not in Marketplace |
| FIPS-validated encryption in transit and at rest3.13.11, with 3.13.8 and 3.13.16 | FIPS 140-3 stated | FIPS 140-3 stated | FIPS policy, opt-in | FIPS 140-2 stated |
| Administered and supported only by US persons22 CFR 120.50(b), 120.56(a) | US citizens stated | US citizens stated | US citizens stated | Not stated |
| Supports 72-hour incident reporting and 90-day image retentionDFARS 252.204-7012(c)–(g) | Stated | Not stated | 72 h not stated | Not stated |
| Audit logs you can export3.3.1, 3.3.2 | Export stated | Export stated | Logs in your account | Export not stated |
| Outside the boundary | ||||
| SFTP or FTPS endpoint for partner systems | Stated | Stated | Stated | Stated |
| Scheduled or event-driven transfers | Your scheduler | Stated | Stated | Add-on stated |
| API for your own software | Stated | Stated | Stated | Stated |
| Branded portal for suppliers | Your subdomain | Not stated | Stated | Stated |
What the words mean
- MeetsCertified host (Moderate)FIPS 140-3 statedUS citizens statedStatedExport statedCertified (Moderate)Certified (High)Logs in your accountFIPS 140-2 stated
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialYour schedulerYour subdomainFIPS policy, opt-in72 h not statedExport not statedAdd-on stated
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot statedNot in Marketplace
- Not stated in what we read. Ask the vendor in writing before you rely on it.
SFTP protects the pipe, not the file
SFTP and FTPS encrypt the connection. When the file lands, the server software can read it, whatever it does to protect its disks. That matters for ITAR, because the rule's encryption carve-out asks for more than a secure connection.
| Path | Your machine | On the wire | On the server | At the partner |
|---|---|---|---|---|
| SFTP or FTPS alone | Readable | Encrypted | Readable to the service | Readable |
| File encrypted first, then sent | Readable | Encrypted | Encrypted | Readable |
End to end means the file is never decrypted between your security boundary and the recipient's, and no third party, the transfer service included, holds the means to decrypt it. A plain SFTP drop does not meet that test. So a hosted endpoint has to keep files in the United States with only US persons able to reach them, the same test the file sharing comparison applies to cloud storage. Encrypting the file before it leaves, with FIPS-validated modules and keys only you and the partner hold, is how a transfer can reach the carve-out instead. Watch the tooling: Sharetru leaves PGP on your side, while AWS offers a workflow that decrypts PGP files as they arrive, which puts the readable copy back on the server.
No protocol settles the other two export questions. Sending a drawing to a supplier outside the US is an export that needs DDTC authorization first. Letting a foreign person in the US open it is an export too, to every country of their citizenship or permanent residency. And if the file is covered defense information going to a supplier, DFARS 7012(m) puts the clause in their subcontract. The ITAR compliance checklist covers the export side; the clause itself is in DFARS 252.204-7012 explained.
Scripts need names too
Much of the traffic on a transfer server is not people: the ERP pushing an advance ship notice, a quality job dropping inspection reports, a supplier's system collecting a purchase order. The rule counts those processes as users AC.L2-3.1.1, and every action has to trace back to one of them AU.L2-3.3.2. A shared login breaks that on the first night.
Example only
- Time
- 2026-10-21 23:00:04
- Account
- ftpuser
- From
- 10.0.4.17
- Action
- put FAI-0412.pdf
- Who ran it
- Unknown: four jobs and two people use this login
Example only
- Time
- 2026-10-21 23:00:04
- Account
- svc-quality-push
- From
- 10.0.4.17, the only address it may use
- Action
- put FAI-0412.pdf to /prime-a/in
- Who ran it
- The nightly inspection job, owner: quality lead
- 01
One account per job
Name it for the job, not the person who wrote the script, and record its owner in the SSP.
3.3.2
- 02
A key, not a password in the script
SSH keys or certificates authenticate the process; a password in a batch file is a password anyone with the file share can read.
3.5.2
- 03
Pin it down
One source address, one protocol, one folder. A drop account that can write but not list keeps a stolen key from browsing everyone's files.
3.1.1; 3.1.2
- 04
Read the log as the assessor will
Pick a file from last month and trace it to a job and a person. If you cannot, neither can they.
3.3.1
If you run the server yourself
Plenty of shops run their own transfer server, and products such as MOVEit Transfer are sold to run on premises. That route skips the FedRAMP question for the software, and hands you the patch race. File-transfer servers face the internet by design, and attackers have gone after them again and again: CISA's catalog of vulnerabilities known to be exploited lists 18 entries for the 7 products below, 11 of them marked as used in ransomware campaigns.
| Product | Entries | Added to the catalog | Ransomware use |
|---|---|---|---|
| Accellion FTA | 4 | 2021-11-03 | Known on 4 |
| SolarWinds Serv-U | 4 | 2021-11-03 to 2026-06-05 | Known on 1 |
| Fortra GoAnywhere MFT | 2 | 2023-02-10 to 2025-09-29 | Known on 2 |
| Progress MOVEit Transfer | 1 | 2023-06-02 | Known on 1 |
| CrushFTP | 3 | 2024-04-24 to 2025-07-22 | Known on 1 |
| Cleo Harmony, VLTrader, LexiCom | 2 | 2024-12-13 to 2024-12-17 | Known on 2 |
| Wing FTP Server | 2 | 2025-07-14 to 2026-03-16 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog, version 2026.10.21, read 2026-10-22. The date is when CISA added the entry, not when the attacks began. The list is ours: we searched the catalog for these products.
None of this says a hosted service is safer by default. It says who carries the risk. On your own server, flaw remediation SI.L2-3.14.1 means watching that list and patching fast, weekends included, on a box that is a CUI asset in your assessment scope. If no one on your side can promise that, a listed service or your managed service provider should run it.
The services, one by one
Sharetru Federal
What it is. A hosted transfer endpoint for CUI and ITAR files: SFTP, SCP, FTPS and an HTTPS REST API for systems, the web app and links for people, all on one hostname. It runs inside the GovPoint Cloud Services FedRAMP Moderate package, where the Marketplace lists it by name. It has no job engine of its own: cron, Task Scheduler or your own code triggers every transfer.
Who it fits. A shop replacing an old SFTP server in the office, with scripts that push inspection reports to primes every night and suppliers who drop files in with their own clients.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified host (Moderate) |
| Administered and supported only by US persons | US citizens stated |
| Scheduled or event-driven transfers | Your scheduler |
Checked on sharetru.com, 2026-10-22
Check with the vendor before you buy.
Kiteworks Federal Cloud
What it is. One platform for managed file transfer, an SFTP server, file sharing, secure email and web forms, under one audit log. Its MFT runs transfers on a schedule, by polling a folder or on an event. Kiteworks Federal Cloud is FedRAMP Certified at Moderate; its Secure Gov Cloud is listed as Agency Authorization In Process at High.
Who it fits. A shop that wants the transfer engine and the schedule hosted for it, and that moves drawings over several channels at once: SFTP to a prime's system, a portal for suppliers, email for the one-off.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified (Moderate) |
| Administered and supported only by US persons | US citizens stated |
| Supports 72-hour incident reporting and 90-day image retention | Not stated |
Checked on kiteworks.com, 2026-10-22
Check with the vendor before you buy.
AWS Transfer Family (GovCloud)
What it is. Amazon's managed SFTP, FTPS, FTP and AS2 endpoint, writing straight into S3 or EFS storage in your own AWS account. In the AWS GovCloud (US) regions it sits inside the AWS GovCloud package, FedRAMP Certified at High. You build the rest: users, keys, storage, the FIPS security policy, logging and any portal.
Who it fits. A shop whose IT provider already runs its CUI enclave in AWS GovCloud and wants partners' SFTP jobs to land in the same account. Not a turnkey service for a shop with no AWS skills in house.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Certified (High) |
| FIPS-validated encryption in transit and at rest | FIPS policy, opt-in |
| Administered and supported only by US persons | US citizens stated |
Checked on aws.amazon.com, 2026-10-22
Check with the vendor before you buy.
Progress MOVEit Cloud
What it is. The hosted edition of Progress MOVEit managed file transfer: SFTP, FTPS and HTTPS, an API, custom branding and tamper-evident logs, run by Progress in the Azure Cloud. Scheduled workflows come from a separate product, MOVEit Automation.
Who it fits. A shop whose prime already trades files with MOVEit and wants the same tool, for data that is not CUI, or once Progress shows written evidence that the hosted service meets the FedRAMP Moderate baseline.
| What the rule asks | What we found |
|---|---|
| FedRAMP Moderate or equivalent, for a cloud that holds CUI | Not in Marketplace |
| FIPS-validated encryption in transit and at rest | FIPS 140-2 stated |
| Administered and supported only by US persons | Not stated |
Checked on progress.com, 2026-10-22
Check with the vendor before you buy.
How we read the services
Questions about moving ITAR files
Is SFTP ITAR compliant?
No protocol is, because the ITAR certifies no product or protocol. SFTP encrypts the connection, which the 800-171 transmission requirement asks for. The ITAR question is who can read the file at either end and on the server, so an SFTP drop on a hosted service still needs US storage and US-person administrators, unless the file was encrypted end to end before it left.
Is FTPS as good as SFTP for CUI?
Either one encrypts the session; plain FTP does not and should be switched off. What decides 3.13.11 is the cryptographic module underneath, so ask for the CMVP certificate number of the module the server and your client use. A product that is "FIPS compliant" relies on a validated module somewhere; one that is "FIPS validated" is the module itself.
We run our SFTP server on a cloud virtual machine. Does FedRAMP apply?
To the cloud, yes: a provider that stores or transmits covered defense information has to meet the FedRAMP Moderate baseline or its equivalent. Both AWS's commercial US regions (Moderate) and AWS GovCloud (High) are FedRAMP Certified. For ITAR data, GovCloud is the one AWS describes as operated by US citizens on US soil. The server you build on top is yours to secure. The FedRAMP Moderate equivalency guide explains the test for a provider that is not listed.
What should I ask a transfer vendor for before I sign?
- The FedRAMP Marketplace package ID, or the body of evidence for an equivalency claim.
- The customer responsibility matrix, for your SSP.
- The FIPS certificate numbers of the modules used in transit and at rest.
- A contract line on US data location and US-person administration.
- How long logs are kept, and how you export them.
- How they will help you report within 72 hours and preserve images for 90 days.
Our prime sends drawings through its own portal. Is that enough?
For the trip, usually: their portal is their system and their cloud question. Your part starts at download. The laptop that fetches the package holds CUI and is in your scope, and if your staff forward it on by email, the portal's protection ends there. The CMMC- and ITAR-ready email comparison covers that second hop.
Does the CMMC suspension change how we send drawings?
No. The suspension stops contracts adding third-party CMMC assessments. DFARS 252.204-7012, its FedRAMP test for cloud and NIST SP 800-171 Rev 2 still apply, and ITAR is a separate rule from the State Department. What still applies today.