Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Browse requirements
X-CUI-FEDRAMP Informational

Use FedRAMP-Authorized Cloud for CUI (DoD: FedRAMP-Moderate Equivalent)

Official citation: FedRAMP; DFARS 252.204-7012(b)(2)

Class: informational · Severity: medium

Requirement text

FedRAMP; DFARS 252.204-7012(b)(2)

What it means

If you store or process CUI in the cloud, the service generally must be FedRAMP-authorized; for DoD CUI, DFARS 252.204-7012(b)(2) requires at least FedRAMP-Moderate-equivalent security plus the clause's additional terms. Choosing a non-compliant cloud is a frequent gap that can derail an assessment.

Required by

  • — 32 CFR Part 2002
  • GovCon — 32 CFR Part 2002
  • IT/Cloud — 32 CFR Part 2002
  • DIB — 32 CFR Part 2002

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.