by Meta
FedRAMP Status
Not FedRAMP Authorized
Impact Level
N/A
Category
Secure Messaging
Overview
WhatsApp is explicitly prohibited by DoD for non-public information. Despite this, it is widely used in practice, especially at overseas posts. It lacks audit trails, data retention controls, and is subject to Meta data collection policies. CUI must never be transmitted via WhatsApp.
CUI Risk Assessment
DoD explicitly prohibits WhatsApp for non-public DoD information. No audit trails, no data retention, Meta data collection. Widely used in practice despite prohibition.
NIST 800-171 Violations
Using WhatsApp for CUI without FedRAMP authorization may violate these NIST 800-171 controls:
FedRAMP Compliant Alternatives
Frequently Asked Questions
Can I use WhatsApp for defense work communications?
No. DoD explicitly prohibits WhatsApp for non-public DoD information. Use AWS Wickr, which has DoD IL4/IL5 authorization for encrypted messaging.
Run a Full Tech Stack Audit
Check all your enterprise tools at once with our free CUI Compliance Auditor.
Launch CUI Auditor