Clear Path step · Business · Your industry's rules and risks
Keep CUI in a cloud environment that meets DFARS 7012
Why it matters: DFARS 7012 sets requirements for cloud services that store CUI. Standard commercial editions of popular suites may not meet them.
On your path if you picked “Government contractor” for “What's your industry?”.
Do it
- Ask each cloud provider for its FedRAMP status and DFARS 7012 commitments in writing.
- Move CUI into a government-cloud edition or an enclave that meets the requirements.
- Block CUI from personal and standard commercial accounts.
- Document it in your system security plan.
Check it worked: CUI lives only in email, file and collaboration services that meet FedRAMP Moderate baseline equivalency and the DFARS 7012 incident terms, and commercial-grade tenants hold none of it.
Simply put
It's like storing controlled documents in a vault that's been inspected, not a rented storage unit. Standard commercial cloud editions may not meet DFARS 7012, so CUI belongs only where the requirements are met in writing.
In detail
CMMC treats an outside IT company that manages your CUI environment as an external service provider within your assessment scope; ask how it meets the same requirements.
Points toward the Long View: controlled data that lives only in services built for it.