CUI Compliant
0 NIST 800-171 gaps detected. Class D (High) on the FedRAMP Marketplace: record Box Enterprise Cloud Content Collaboration Platform (Box Inc.), certified since 2025-03-25, read 2026-07-27. Confirm the plan and region you are buying sit inside that offering before placing CUI there.
Box Government
by Box
FedRAMP Status
FedRAMP Authorized
Impact Level
High
Category
Cloud Storage
Authorized: March 25, 2025
Overview
Box Government is covered by a certified FedRAMP Marketplace record. The FedRAMP Marketplace record behind this is Box Enterprise Cloud Content Collaboration Platform, held by Box Inc.: Class D (High), certified since 2025-03-25, read 2026-07-27 (https://www.fedramp.gov/marketplace/products/F1212191840A/). A certification covers that named offering, not the brand — confirm the plan, region and tenancy you are buying sit inside it before placing CUI there.
CUI Risk Assessment
Class D (High) on the FedRAMP Marketplace: record Box Enterprise Cloud Content Collaboration Platform (Box Inc.), certified since 2025-03-25, read 2026-07-27. Confirm the plan and region you are buying sit inside that offering before placing CUI there.
Deployment & Architecture
Deployment Model: Government Cloud (FedRAMP boundary)
Box Government operates within a FedRAMP-authorized boundary. CUI can be processed within the authorization scope, but contractors must verify their specific use case falls within the system's security boundary as documented in the SSP.
Configuration Checklist
- 1ISSO must update the System Security Plan to document Box Government as an external system connection with defined data flows and security controls inheritance.
- 2System administrator shall configure organizational units in Box Government aligned with contract security requirements and CUI handling procedures.
- 3ISSO must establish data classification policies within Box Government ensuring CUI markings are preserved and enforced throughout content lifecycle.
- 4System administrator shall implement FIPS 140-2 validated encryption for all CUI data at rest and configure secure transmission protocols.
- 5ISSO must create role-based access control matrices limiting CUI access to personnel with appropriate security clearances and need-to-know.
- 6System administrator shall configure audit logging to capture all CUI access events and privileged user activities per NIST 800-171 AU requirements.
- 7ISSO must establish quarterly user access reviews and document procedures for prompt access revocation upon personnel changes.
- 8System administrator shall implement data loss prevention policies preventing unauthorized CUI sharing and external collaboration.
- 9Contracts officer must validate interconnection security agreements with Box Government meet DFARS 252.204-7012 requirements.
- 10ISSO must conduct validation testing of all CUI handling procedures and document results in compliance assessment reports.
Other FedRAMP Authorized Cloud Storage Tools
Related Compliance Assessments
Frequently Asked Questions
Is Box Government FedRAMP authorized?
The FedRAMP Marketplace record behind this is Box Enterprise Cloud Content Collaboration Platform, held by Box Inc.: Class D (High), certified since 2025-03-25, read 2026-07-27 (https://www.fedramp.gov/marketplace/products/F1212191840A/). A certification covers that named offering, not the brand — confirm the plan, region and tenancy you are buying sit inside it before placing CUI there.
Run a Full Tech Stack Audit
Check all your enterprise tools at once with our free CUI Compliance Auditor.
Launch CUI AuditorGet a defensible CUI architecture
This Box Government CUI review flags the gaps. The next step is a compliance architecture review where we map your data flows to FedRAMP-authorized alternatives and CMMC-aligned controls.
Schedule architecture reviewRelated: how much CMMC certification costs — DoD’s own priced figures