---
title: "Encrypted CUI and FedRAMP: Latest Guidance from the DoD"
description: Read the DoD's guidance on encrypting CUI as it travels in and out of FedRAMP environments. Encrypted CUI is still CUI, but there's important context.
image: https://www.virtru.com/hubfs/assets/images/resource%20cards/encrypted-cui-dod.webp
---

[Skip to Main Content](https://www.virtru.com/blog/compliance/cmmc/encrypted-cui-fedramp#main-content)

[Sign In](https://secure.virtru.com/dashboard) [I received a Virtru email](https://www.virtru.com/data-protection-platform/email-encryption/send)

[![Virtru](https://www.virtru.com/hubfs/assets/images/logos/virtru/blue/virtru_LOGOMASTER_BLUE.svg) ](https://www.virtru.com/)

- Products
- Solutions
- Developers
- Company
- Resources
- [Support](https://support.virtru.com)
- [Pricing](https://www.virtru.com/data-security-platform/pricing-packages)
- Book a Demo
- Search all Virtru content
  
  ![](https://www.virtru.com/hubfs/assets/images/icons/link-arrow-black.svg)

Email Workflows

Protect data shared via email

- [Virtru for Gmail 
  
  ](https://www.virtru.com/data-security-platform/email-encryption/gmail)
- [Virtru for Outlook 
  
  ](https://www.virtru.com/data-security-platform/email-encryption/outlook)
- [Virtru Gateway 
  
  ](https://www.virtru.com/data-security-platform/virtru-data-gateway)
- [Email Integrations 
  
  ](https://www.virtru.com/products/integrations?product=data_protection_gateway&category=email)

File Workflows

Protect files shared across your workflows

- [Virtru Secure Share 
  
  ](https://www.virtru.com/data-security-platform/virtru-secure-share)
- [Virtru for Desktop 
  
  ](https://www.virtru.com/data-security-platform/desktop)
- [File Integrations 
  
  ](https://www.virtru.com/products/integrations?category=file_sharing)

Collaboration Workflows

FedRAMP authorized file storage and collaboration

- [Virtru Collaborate 
  
  ](https://www.virtru.com/data-security-platform/virtru-collaborate)

Manage Private Encryption Keys

Maintain complete sovereignty and governance

- [Virtru Private Keystore 
  
  ](https://www.virtru.com/data-security-platform/virtru-private-keystore)
- [Google Client Side Encryption (CSE) 
  
  ](https://www.virtru.com/data-security-platform/google-workspace-client-side-encryption)

Develop Data Security Solutions

Data-centric security, built on open standards

- [Virtru Data Security Platform 
  
  ](https://www.virtru.com/data-security-platform)
- [Developer Experience 
  
  ](https://www.virtru.com/data-security-platform/developer-experience)
- [Platform Integrations 
  
  ](https://www.virtru.com/partners/technology)

6,100+ Customers Trust Virtru for Data Security and Privacy Protection

![Omada Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/omada-logo.webp) ![UC Berkley Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/ucberkley-logo.webp) ![Associated Press Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/associatedpress-logo.webp) ![US Department of Defense Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/dod-logo.webp)

- Compliance
  
    - [CJIS 
      
      ](https://www.virtru.com/compliance/cjis)
    - [CMMC / NIST / DFARS 
      
      ](https://www.virtru.com/compliance/cmmc)
    - [FERPA 
      
      ](https://www.virtru.com/compliance/ferpa)
    - [FTC Safeguards Rule 
      
      ](https://www.virtru.com/compliance/data-encryption-ftc-safeguards-rule)
    - [GDPR 
      
      ](https://www.virtru.com/compliance/gdpr)
    - [HIPAA 
      
      ](https://www.virtru.com/compliance/hipaa-email)
    - [ISO 27001 
      
      ](https://www.virtru.com/compliance/iso-27001)
    - [ITAR 
      
      ](https://www.virtru.com/compliance/itar)
    - [PCI / GLBA / FINRA / SOX 
      
      ](https://www.virtru.com/compliance/financial)
- Commercial
  
    - [Aerospace 
      
      ](https://www.virtru.com/industry-solutions/aerospace-and-defense/)
    - [Education 
      
      ](https://www.virtru.com/industry-solutions/education/)
    - [Finance 
      
      ](https://www.virtru.com/industry-solutions/financial-services/)
    - [Healthcare 
      
      ](https://www.virtru.com/industry-solutions/healthcare/)
    - [Legal 
      
      ](https://www.virtru.com/industry-solutions/legal)
    - [Technology & Telecom 
      
      ](https://www.virtru.com/industry-solutions/telecom-it-and-software)
    - [Threat Intelligence 
      
      ](https://www.virtru.com/industry-solutions/threat-intelligence)
- Global Public Sector
  
    - [Federal - Defense 
      
      ](https://www.virtru.com/global-public-sector/defense)
    - [Federal - Intelligence 
      
      ](https://www.virtru.com/global-public-sector/intelligence)
    - [State & Local Government 
      
      ](https://www.virtru.com/industry-solutions/state-local-government)
    - [Systems Integrators 
      
      ](https://www.virtru.com/global-public-sector/systems-integrators)
    - [Mission Partner Environments 
      
      ](https://www.virtru.com/industry-solutions/mission-partner-environments)

[View All Solutions](https://www.virtru.com/compliance)

[![Three rings forming three overlaps in a triangle formation](https://www.virtru.com/hubfs/assets/images/icons/rings-navicon.svg)

Virtru for Global Mission Partners

Data-centric security aligned with ACP-240 and TDF

Learn More ](https://www.virtru.com/industry-solutions/mission-partner-environments) [![Microsoft Icon](https://www.virtru.com/hubfs/assets/images/icons/microsoft-navicon.svg)

Virtru for Microsoft 365

Protect data stored and shared via Microsoft 365

Learn More ](https://www.virtru.com/data-security-platform/microsoft-365) [![Google Icon](https://www.virtru.com/hubfs/assets/images/icons/google-navicon.svg)

Virtru for Google Workspace

Protect data stored and shared via Google Workspace

Learn More ](https://www.virtru.com/data-security-platform/google-workspace)

- Developers
  
    - [Virtru Data Security Platform The Security Standard that Powers Our Products 
      
      ](https://www.virtru.com/data-security-platform)
    - [Trusted Data Format Secure Collaboration and Policy Enforcement 
      
      ](https://www.virtru.com/data-security-platform/trusted-data-format)
    - [Virtru Developer Experience Build Secure Solutions from the Ground Up 
      
      ](https://www.virtru.com/data-security-platform/developer-experience)
- Developer Community
  
    - [OpenTDF: Open Source Project Open Standard Now Available on GitHub 
      
      ](https://opentdf.io/)
    - [Technology Partners Building integrations with the Virtru Platform 
      
      ](https://www.virtru.com/partners/technology)
    - [Partner Training Bootcamp Request training on the Virtru Data Security Platform 
      
      ](https://www.virtru.com/data-security-platform/training-request)

![Looking over the shoulder of somebody on their smart phone. ](https://www.virtru.com/hubfs/assets/images/stock%20photos/People%20On%20Device/person-on-phone.webp)

A trusted platform for secure data sharing

Built on the open TDF standard, the Virtru Data Security Platform provides persistent control over the information you share with others.

[Virtru Data Security Platform](https://www.virtru.com/data-security-platform)

- About Virtru
  
    - [About Us 
      
      ](https://www.virtru.com/about-us)
    - [Leadership 
      
      ](https://www.virtru.com/leadership/)
    - [Careers & Culture 
      
      ](https://www.virtru.com/careers)
    - [Contact Us 
      
      ](https://www.virtru.com/contact-us)
- In the News
  
    - [Headlines & Press Releases 
      
      ](https://www.virtru.com/newsroom)
    - [Decrypted Blog 
      
      ](https://www.virtru.com/blog)
    - [Hash It Out Podcast 
      
      ](https://www.virtru.com/hash-it-out)

Award-winning security solutions for every organization

![Cyber Security Breakthrough Award Logo for 2023](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/cybersecurity-breakthrough-award-badge-2023.webp) ![Virtru wins a G2 Top 50 Security Products Award for 2024](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/G2-Leader-2025.webp) ![Washington Post Top Work Places 2023 Award](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/twp-washington-2023.webp) ![Inc Power Partner 2024](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/IncPowerPartner-2024.webp) 

[Read Customer Reviews](https://www.virtru.com/why-virtru/reviews)

- Resources
  
    - [Decrypted Blog Tips, Takes, and Expertise 
      
      ](https://www.virtru.com/blog)
    - [Hash It Out Podcast Join us as we talk about cybersecurity 
      
      ](https://www.virtru.com/hash-it-out)
    - [Voice of the Customer Case Studies, Webinars, and Videos 
      
      ](https://www.virtru.com/resources?type=webinar,case-study)
    - [Events & Webinars Upcoming Events, Conferences, and Digital Webinars 
      
      ](https://www.virtru.com/events-and-webinars/)
    - [Resource Library Whitepapers, Guides, and Videos 
      
      ](https://www.virtru.com/resources)
    - [DMV Rising Our annual event bringing together the cyber community in the DMV 
      
      ](https://dmvrising.com/)
    - [Headlines & Press Virtru in the News 
      
      ](https://www.virtru.com/newsroom)
    - [Product Updates The latest on new products, features, and fixes 
      
      ](https://www.virtru.com/products/updates)
    - [Virtru Academy Live Helpful how-to content for admins and end users 
      
      ](https://www.virtru.com/virtru-academy-live)

![Professional on a laptop](https://www.virtru.com/hubfs/assets/images/stock%20photos/business/Business-3.webp)

![Wealthforge Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/Wealthforge%20Logo.webp)

100% Increase in delivery rate for a broker-dealer working to comply with SEC regulations.

[Read the Case Study](https://www.virtru.com/case-studies/wealthforge-sec-compliance-gateway)

- Products 
  
    - Email Workflows
      
      Protect data shared via email
      
          - [Virtru for Gmail 
            
            ](https://www.virtru.com/data-security-platform/email-encryption/gmail)
          - [Virtru for Outlook 
            
            ](https://www.virtru.com/data-security-platform/email-encryption/outlook)
          - [Virtru Gateway 
            
            ](https://www.virtru.com/data-security-platform/virtru-data-gateway)
          - [Email Integrations 
            
            ](https://www.virtru.com/products/integrations?product=data_protection_gateway&category=email)
    - File Workflows
      
      Protect files shared across your workflows
      
          - [Virtru Secure Share 
            
            ](https://www.virtru.com/data-security-platform/virtru-secure-share)
          - [Virtru for Desktop 
            
            ](https://www.virtru.com/data-security-platform/desktop)
          - [File Integrations 
            
            ](https://www.virtru.com/products/integrations?category=file_sharing)
    - Collaboration Workflows
      
      FedRAMP authorized file storage and collaboration
      
          - [Virtru Collaborate 
            
            ](https://www.virtru.com/data-security-platform/virtru-collaborate)
    - Manage Private Encryption Keys
      
      Maintain complete sovereignty and governance
      
          - [Virtru Private Keystore 
            
            ](https://www.virtru.com/data-security-platform/virtru-private-keystore)
          - [Google Client Side Encryption (CSE) 
            
            ](https://www.virtru.com/data-security-platform/google-workspace-client-side-encryption)
    - Develop Data Security Solutions
      
      Data-centric security, built on open standards
      
          - [Virtru Data Security Platform 
            
            ](https://www.virtru.com/data-security-platform)
          - [Developer Experience 
            
            ](https://www.virtru.com/data-security-platform/developer-experience)
          - [Platform Integrations 
            
            ](https://www.virtru.com/partners/technology)
- Solutions 
  
    - Compliance
      
          - [CJIS 
            
            ](https://www.virtru.com/compliance/cjis)
          - [CMMC / NIST / DFARS 
            
            ](https://www.virtru.com/compliance/cmmc)
          - [FERPA 
            
            ](https://www.virtru.com/compliance/ferpa)
          - [FTC Safeguards Rule 
            
            ](https://www.virtru.com/compliance/data-encryption-ftc-safeguards-rule)
          - [GDPR 
            
            ](https://www.virtru.com/compliance/gdpr)
          - [HIPAA 
            
            ](https://www.virtru.com/compliance/hipaa-email)
          - [ISO 27001 
            
            ](https://www.virtru.com/compliance/iso-27001)
          - [ITAR 
            
            ](https://www.virtru.com/compliance/itar)
          - [PCI / GLBA / FINRA / SOX 
            
            ](https://www.virtru.com/compliance/financial)
    - Commercial
      
          - [Aerospace 
            
            ](https://www.virtru.com/industry-solutions/aerospace-and-defense/)
          - [Education 
            
            ](https://www.virtru.com/industry-solutions/education/)
          - [Finance 
            
            ](https://www.virtru.com/industry-solutions/financial-services/)
          - [Healthcare 
            
            ](https://www.virtru.com/industry-solutions/healthcare/)
          - [Legal 
            
            ](https://www.virtru.com/industry-solutions/legal)
          - [Technology & Telecom 
            
            ](https://www.virtru.com/industry-solutions/telecom-it-and-software)
          - [Threat Intelligence 
            
            ](https://www.virtru.com/industry-solutions/threat-intelligence)
    - Global Public Sector
      
          - [Federal - Defense 
            
            ](https://www.virtru.com/global-public-sector/defense)
          - [Federal - Intelligence 
            
            ](https://www.virtru.com/global-public-sector/intelligence)
          - [State & Local Government 
            
            ](https://www.virtru.com/industry-solutions/state-local-government)
          - [Systems Integrators 
            
            ](https://www.virtru.com/global-public-sector/systems-integrators)
          - [Mission Partner Environments 
            
            ](https://www.virtru.com/industry-solutions/mission-partner-environments)
- Developers 
  
    - Developers
      
          - [Virtru Data Security Platform The Security Standard that Powers Our Products 
            
            ](https://www.virtru.com/data-security-platform)
          - [Trusted Data Format Secure Collaboration and Policy Enforcement 
            
            ](https://www.virtru.com/data-security-platform/trusted-data-format)
          - [Virtru Developer Experience Build Secure Solutions from the Ground Up 
            
            ](https://www.virtru.com/data-security-platform/developer-experience)
    - Developer Community
      
          - [OpenTDF: Open Source Project Open Standard Now Available on GitHub 
            
            ](https://opentdf.io/)
          - [Technology Partners Building integrations with the Virtru Platform 
            
            ](https://www.virtru.com/partners/technology)
          - [Partner Training Bootcamp Request training on the Virtru Data Security Platform 
            
            ](https://www.virtru.com/data-security-platform/training-request)
- Company 
  
    - About Virtru
      
          - [About Us 
            
            ](https://www.virtru.com/about-us)
          - [Leadership 
            
            ](https://www.virtru.com/leadership/)
          - [Careers & Culture 
            
            ](https://www.virtru.com/careers)
          - [Contact Us 
            
            ](https://www.virtru.com/contact-us)
    - In the News
      
          - [Headlines & Press Releases 
            
            ](https://www.virtru.com/newsroom)
          - [Decrypted Blog 
            
            ](https://www.virtru.com/blog)
          - [Hash It Out Podcast 
            
            ](https://www.virtru.com/hash-it-out)
- Resources 
  
    - Resources
      
          - [Decrypted Blog Tips, Takes, and Expertise 
            
            ](https://www.virtru.com/blog)
          - [Hash It Out Podcast Join us as we talk about cybersecurity 
            
            ](https://www.virtru.com/hash-it-out)
          - [Voice of the Customer Case Studies, Webinars, and Videos 
            
            ](https://www.virtru.com/resources?type=webinar,case-study)
          - [Events & Webinars Upcoming Events, Conferences, and Digital Webinars 
            
            ](https://www.virtru.com/events-and-webinars/)
          - [Resource Library Whitepapers, Guides, and Videos 
            
            ](https://www.virtru.com/resources)
          - [DMV Rising Our annual event bringing together the cyber community in the DMV 
            
            ](https://dmvrising.com/)
          - [Headlines & Press Virtru in the News 
            
            ](https://www.virtru.com/newsroom)
          - [Product Updates The latest on new products, features, and fixes 
            
            ](https://www.virtru.com/products/updates)
          - [Virtru Academy Live Helpful how-to content for admins and end users 
            
            ](https://www.virtru.com/virtru-academy-live)
- [Support](https://support.virtru.com)
- [Pricing](https://www.virtru.com/data-security-platform/pricing-packages)
- Book a Demo
- Search all Virtru content
  
  ![](https://www.virtru.com/hubfs/assets/images/icons/link-arrow-black.svg)

Defense. CMMC/NIST/DFARS

December 18, 2025

# Encrypted CUI and FedRAMP: Latest Guidance from the DoD

![Megan Leader](https://www.virtru.com/hubfs/assets/images/headshots/megan-leader-headshot.webp)

By Megan Leader

Share post:

[![Share on Facebook](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-facebook.png?noresize&width=24&name=icon-blog-facebook.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-linkedin.png?noresize&width=24&name=icon-blog-linkedin.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://www.virtru.com/hs-fs/hubfs/opentdf/assets/images/icons/x-logo.webp?width=24&name=x-logo.webp)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Encrypted%20CUI%20and%20FedRAMP%3A%20Latest%20Guidance%20from%20the%20DoD)

## TABLE OF CONTENTS

See Virtru In Action

Book a Demo

Share post:

[![Share on Facebook](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-facebook.png?noresize&width=24&name=icon-blog-facebook.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-linkedin.png?noresize&width=24&name=icon-blog-linkedin.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://www.virtru.com/hs-fs/hubfs/opentdf/assets/images/icons/x-logo.webp?width=24&name=x-logo.webp)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fcmmc%2Fencrypted-cui-fedramp%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Encrypted%20CUI%20and%20FedRAMP%3A%20Latest%20Guidance%20from%20the%20DoD)

![ciphertext](https://www.virtru.com/hubfs/assets/images/resource%20cards/encrypted-cui-dod.webp)

For defense contractors pursuing CMMC compliance, one question has been lingering: Does Controlled Unclassified Information (CUI) have to remain in a FedRAMP environment at all times, or can it move through lower-security environments with the right protections? The Department of Defense/Department of War (DoD/DoW)  has provided some updated guidance in its [November 2025 CMMC FAQ ](https://dowcio.war.gov/Portals/0/Documents/CMMC/CMMC-FAQsv3.pdf)— but it still leaves room for interpretation. 

In this post, we’ll assess the updated guidance around encrypted CUI for defense contractors, as well as some additional context to support the FAQ text. 

## DoD CIO: Yes, Encrypted CUI is still CUI

The [DoD’s November 2025 CMMC FAQ](https://dowcio.war.gov/Portals/0/Documents/CMMC/CMMC-FAQsv3.pdf) says that, yes, CUI remains CUI even when it is encrypted. Here is the full text from this section of the FAQ:

> Is encrypted CUI still considered to be CUI? 
> 
> B-A8. In accordance with 32 CFR Part 2002, CUI remains controlled until it is formally decontrolled. As such, encrypted CUI data retains the control designation given to the plain text counterpart. While it is true that certain risks (e.g., transmission across unsecured, "common carrier" networks) may be accepted for cipher text that would not be accepted for plain text, this does not mean the original, controlled information, nor the data (plain or cipher text) representing it, is considered decontrolled.

This means that, regardless of whether it’s encrypted or not, CUI remains sensitive and requires governance as such. It does not fundamentally change once it is encrypted. And this is no surprise: Of course, a PDF containing CUI is inherently still CUI when it is encrypted and shared. 

## However, ‘Certain Risks May Be Accepted for Cipher Text.’

This FAQ answer goes on to say that “Certain risks (e.g., transmission across unsecured, ‘common carrier’ networks) may be accepted for cipher text that would not be accepted for plain text.” This indicates some flexibility in how CUI is shared in its encrypted state. Presumably, this would be similar to how encrypted data is controlled for [ITAR (International Traffic in Arms Regulation)](https://www.virtru.com/compliance/itar). 

ITAR stipulates an [encryption carve-out rule](https://www.virtru.com/resource/itar-encryption-carve-out-webinar) for end-to-end encrypted data as an export. ITAR controlled data is a subset of CUI. And, with ITAR, end-to-end encryption and granular access control demonstrate adequate governance and security of CUI data. 

## FedRAMP Storage Is Your Safest Bet for CUI Protection

All this being said, [storing CUI in a FedRAMP authorized location](https://www.virtru.com/compliance/fedramp) — and protecting it with end-to-end encryption and granular access control — remains your best bet for securing CUI in a manner that will pass CMMC Level 2 assessment. 

Virtru enables CMMC-compliant [CUI storage and sharing](https://www.virtru.com/blog/compliance/cui) with several of our products, including: 

- [Virtru for Gmail:](https://www.virtru.com/data-security-platform/email-encryption/gmail) Virtru provides client-side, end-to-end encryption for Gmail. [Google Workspace can be configured for FedRAMP High](https://support.google.com/a/answer/13190816?hl=en), which meets the FedRAMP storage requirement, while Virtru allows for controlled, encrypted sharing outside of your organizational boundary. 
-  [Virtru for Microsoft Outlook](https://www.virtru.com/data-security-platform/email-encryption/outlook): Virtru email encryption can be used in Microsoft 365 Commercial Cloud as well as its Government Cloud. To meet the highest level of CMMC security, attach any CUI as a file attachment, which will store it in Virtru’s FedRAMP authorized environment. What appears as an attachment to the recipient is actually a link to authenticate and access the encrypted, FedRAMP-stored data object.
- [Virtru Secure Share:](https://www.virtru.com/data-security-platform/virtru-secure-share) Files stored in Virtru Secure Share are also located in Virtru’s FedRAMP-authorized cloud environment. This tool allows you to send and receive encrypted, access-controlled  files, making it valuable for contractors who collaborate externally. 
- [Virtru Private Keystore:](https://www.virtru.com/data-security-platform/virtru-private-keystore) For an added layer of control over your encrypted CUI, you can optionally choose to host your own encryption keys on-premises or in a virtual private cloud. 

It’s important to note that [Virtru is FedRAMP authorized](https://trust.virtru.com/docs/compliance/fedramp) at the moderate level and listed on the [FedRAMP Marketplace](https://marketplace.fedramp.gov/products/F1605037894). Other vendors who tout [FedRAMP equivalency](https://www.virtru.com/blog/compliance/cmmc/fedramp-equivalency) have not undergone assessment by a third-party assessment organization (3PAO); by choosing an “equivalent” organization rather than an “authorized” organization, you as the customer inherit the risk and reporting responsibility in case of a security incident. FedRAMP authorized organizations, however, are thoroughly vetted and responsible for incident reporting and management. 

## Choose a Trusted Partner for Your CMMC Compliance Journey

If you are pursuing CMMC compliance, Virtru will be just one piece of the puzzle. We are clear on exactly which controls we support (up to 27, detailed in the [Virtru Shared Responsibility Matrix](https://www.virtru.com/resource/cmmc-compliance-support-encryption)) and we do not [overpromise on CMMC](https://www.virtru.com/blog/compliance/cmmc/vendor-promises), like other vendors in the space. 

That being said, Virtru is an effective and powerful CUI control that gives you flexibility in how you architect your CMMC strategy. Virtru allows you to scope and manage CUI sharing with FedRAMP authorized storage, providing platform-agnostic solutions that meet you where you work. 

Here's a testimonial from one of our customers who has passed their CMMC Level 2 assessment with Virtru as part of their Microsoft tech stack. 

![](https://fast.wistia.com/embed/medias/lugjlvywck/swatch)

[Contact our team today for a demo of our CMMC solutions](https://www.virtru.com/contact-us). We’d love to talk further about your approach to compliance and how we can support you. 

![Megan Leader](https://www.virtru.com/hubfs/assets/images/headshots/megan-leader-headshot.webp)

### Megan Leader

Megan is the Director of Brand and Content at Virtru. With a background in journalism and editorial content, she loves telling good stories and making complex subjects approachable. Over the past 15 years, her career has followed her curiosity — from the travel industry, to payments technology, to cybersecurity.

[View more posts by Megan Leader](https://www.virtru.com/blog/author/megan-leader)

See Virtru In Action

Book a Demo

Sign Up for the Virtru Newsletter

## Dive Deeper

![](https://www.virtru.com/hubfs/assets/images/icons/left-arrow-circle-blue.webp)

[![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20cyera%20oasis/cyera-oasis.webp)

Commentary

July 29, 2026

### The Coin Has Two Sides: What Cyera's Acquisition of Oasis Tells Us About the Future of Security

](https://www.virtru.com/blog/data-centric-security/cyera-oasis) [![](https://www.virtru.com/hubfs/26-Competitor-Blog%20-%20Virtru%20vs%20Box%20copy.webp)

File Encryption

July 28, 2026

### Virtru Collaborate vs. Box: Secure File Sharing for Businesses of Any Size

](https://www.virtru.com/blog/virtru-collaborate-vs-box-enterprise) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20william%20mcborrough%20recap/cmmc-compass-will-mcborrough.webp)

Compliance

July 22, 2026

### The $600,000 Problem: What the CMMC Pause Actually Revealed About the Defense Industrial Base

](https://www.virtru.com/blog/compliance/mcglobaltech-cmmc-compass) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20three%20stories/three-stories.webp)

Zero Trust

July 21, 2026

### Last Week in Critical Infrastructure: Three Stories You Should Read as One

](https://www.virtru.com/blog/data-centric-security/three-stories-converge) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20cmmc%20on%20hold/CMMC-Pause-CUI-Not.webp)

Public Sector

July 14, 2026

### CMMC Phase II Is Officially on Hold. NIST and DFARS aren't.

](https://www.virtru.com/blog/compliance/cmmc-phase-2-on-hold-nist-dfars) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/2026%20Newsletter%20Assets/jk-HIO.png)

Zero Trust

July 10, 2026

### We Asked Kindervag: Why Are So Many Organizations Still Getting Zero Trust Wrong?

](https://www.virtru.com/blog/zero-trust/kindervag-yeske) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20ShareFile%20Takedown/26-Competitor-Blog-Blog%20-%20Virtru%20vs%20Sharefile.jpg)

File Encryption

July 10, 2026

### Looking for a ShareFile Alternative? Here's What Regulated Organizations Need to Know.

](https://www.virtru.com/blog/file-encryption/citrix-progress-sharefile) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20sendsafely%20takedown/26-Competitor-Blog-Blog%20-%20Virtru%20vs%20SendSafely%20(1).jpg)

File Encryption

July 08, 2026

### SendSafely vs. Virtru: Which Secure File Sharing Platform Protects Your Data After Download?

](https://www.virtru.com/blog/file-encryption/sendsafely) [![](https://www.virtru.com/hubfs/assets/images/blog/26-Competitor-Blog-Blog%20-%20Virtru%20vs%20Dropbox.webp)

File Encryption

July 07, 2026

### Dropbox Alternatives for Secure File Sharing: What IT Teams Are Missing

](https://www.virtru.com/blog/dropbox-alternatives-secure-file-sharing) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20alex%20karp/alex-karp.jpg)

Commentary

July 07, 2026

### Alex Karp Is Right About the AI Problem. He's Missing the Solution.

](https://www.virtru.com/blog/zero-trust/alex-karp-palantir-data-sovereignty) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20SACR%20Report/anna-perrone-commentary%20copy.webp)

Email Encryption

June 29, 2026

### The Email Security Report Every CISO Should Read, And the Questions It Should Inspire

](https://www.virtru.com/blog/email-security/sacr-anna-perrone-report-2026)

![](https://www.virtru.com/hubfs/assets/images/icons/right-arrow-circle-blue.webp)

## Book a Demo

## Become a Partner

Contact us to learn more about our partnership opportunities.

## Become a Compliance Champion

Contact us to learn more about our partnership opportunities.

- Products
  
    - [Product Overview](https://www.virtru.com/data-security-platform/product-overview)
    - [Virtru for Google Workspace](https://www.virtru.com/data-security-platform/google-workspace)
    - [Virtru for Microsoft 365](https://www.virtru.com/data-security-platform/microsoft-365)
    - [Data Protection Gateway](https://www.virtru.com/data-security-platform/virtru-data-gateway)
    - [Pricing](https://www.virtru.com/data-security-platform/pricing-packages)
- Compliance
  
    - [HIPAA](https://www.virtru.com/compliance/hipaa-email)
    - [ITAR](https://www.virtru.com/compliance/itar)
    - [GDPR](https://www.virtru.com/compliance/gdpr)
    - [CJIS](https://www.virtru.com/compliance/cjis)
    - [NIST CUI](https://www.virtru.com/compliance/nist)
    - [CCPA](https://www.virtru.com/compliance/ccpa)
    - [FERPA](https://www.virtru.com/compliance/ferpa)
    - [CMMC](https://www.virtru.com/compliance/cmmc)
- Industries
  
    - [Healthcare](https://www.virtru.com/industry-solutions/healthcare/)
    - [Education](https://www.virtru.com/industry-solutions/education/)
    - [IT & Software](https://www.virtru.com/industry-solutions/telecom-it-and-software)
    - [Federal Government](https://www.virtru.com/global-public-sector)
    - [State & Local Government](https://www.virtru.com/industry-solutions/state-local-government)
    - [Manufacturing](https://www.virtru.com/industry-solutions/manufacturing)
    - [Financial Services](https://www.virtru.com/industry-solutions/financial-services/)
- Platform
  
    - [Email Encryption](https://www.virtru.com/data-security-platform/email-encryption)
    - [File Encryption](https://www.virtru.com/data-security-platform/file-encryption)
    - [Platform Architecture](https://www.virtru.com/data-security-platform/saas)
    - [Trusted Data Format](https://www.virtru.com/data-security-platform/trusted-data-format)
    - [Secure Reader](https://www.virtru.com/data-security-platform/secure-collaboration)
    - [Audit and Control](https://www.virtru.com/data-security-platform/audit-and-control)
    - [Encryption Key Management](https://www.virtru.com/data-security-platform/virtru-private-keystore)
- Resources
  
    - [About Virtru](https://www.virtru.com/about-us)
    - [Blog](https://www.virtru.com/blog)
    - [Careers](https://www.virtru.com/careers)
    - [Leadership & Investors](https://www.virtru.com/leadership/)
    - [News & Press](https://www.virtru.com/press)
    - [Partners](https://www.virtru.com/partners/)
    - [Intellectual Property](https://www.virtru.com/intellectual-property/)
    - [Security Certifications](https://www.virtru.com/data-security-platform/compliance)
    - Resource Library
- Contact Us
  
    - [Contact Us](https://www.virtru.com/contact-us)
    - [Support](https://support.virtru.com/)
    - [Sales](https://www.virtru.com/contact-us)
    - [Become a Partner](https://www.virtru.com/blog/compliance/cmmc/encrypted-cui-fedramp#footer)
    - [Report a Vulnerability](https://www.virtru.com/responsible-disclosure/)

[![Virtur Logo](https://www.virtru.com/hubfs/assets/images/logos/virtru/white/tagline/virtru_TAGLINE_LOGOMASTER_WHITE-01.svg)](https://www.virtru.com/)

Subscribe to Our Newsletter

[![X Icon](https://www.virtru.com/hubfs/assets/images/icons/x-white.svg)](https://x.com/virtruprivacy) [![LinkedIn Icon](https://www.virtru.com/hubfs/assets/images/icons/linkedin-white.svg)](https://www.linkedin.com/company/virtru) [![Youtube Icon](https://www.virtru.com/hubfs/assets/images/icons/youtube-white.svg)](https://www.youtube.com/@Virtru)

© 2026 Virtru · 1801 Pennsylvania Ave NW, 5th Floor, Washington, DC 20006

[Terms](https://www.virtru.com/terms-of-service) & [Privacy](https://www.virtru.com/privacy-policy) | [Cookie Policy](https://www.virtru.com/cookie-policy) & [Preferences ![Pivacy Options logo](https://oag.ca.gov/sites/all/files/agweb/images/privacy/privacyoptions.svg)](https://www.virtru.com/blog/compliance/cmmc/encrypted-cui-fedramp#footer) | [Do Not Sell My Personal Information](https://www.virtru.com/blog/compliance/cmmc/encrypted-cui-fedramp#footer) | [Virtru Trust Center](https://trust.virtru.com/?_ga=2.215796503.1200908638.1747067694-1753239414.1744322796&_gac=1.175361302.1744660048.EAIaIQobChMIppzvranJjAMVN0pHAR3F7gNdEAAYAiAAEgL4qfD_BwE)

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://www.virtru.com/#organization",
  "@type" : "Organization",
  "description" : "Virtru is a data security platform delivering end-to-end encryption and access control for email, files and apps. Trusted by enterprise and defense leaders",
  "logo" : "https://www.virtru.com/hubfs/assets/images/logos/virtru/blue/virtru_LOGOMASTER_BLUE_HighRes.png",
  "name" : "Virtru",
  "sameAs" : [ "https://www.facebook.com/virtruprivacy", "https://www.x.com/virtruprivacy", "https://www.linkedin.com/company/virtru", "https://www.reddit.com/user/virtru_privacy", "https://www.youtube.com/@Virtru" ],
  "url" : "https://www.virtru.com/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Megan Leader",
    "url" : "https://www.virtru.com/blog/author/megan-leader"
  },
  "dateModified" : "2026-01-07T21:13:57.184Z",
  "datePublished" : "2025-12-18T16:01:22.000Z",
  "headline" : "Encrypted CUI and FedRAMP: Latest Guidance from the DoD",
  "image" : [ "https://www.virtru.com/hubfs/assets/images/resource%20cards/encrypted-cui-dod.webp" ],
  "mainEntityOfPage" : {
    "@id" : "https://www.virtru.com/blog/compliance/cmmc/encrypted-cui-fedramp",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.virtru.com/hubfs/virtru2022/images/Virtru%20Logo%20Blue%20(2).svg"
    },
    "name" : "Virtru"
  }
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "ItemList",
  "itemListElement" : [ {
    "@type" : "SiteNavigationElement",
    "name" : "Products",
    "position" : 1
  }, {
    "@type" : "SiteNavigationElement",
    "name" : "Solutions",
    "position" : 2
  }, {
    "@type" : "SiteNavigationElement",
    "name" : "Developers",
    "position" : 3
  }, {
    "@type" : "SiteNavigationElement",
    "name" : "Company",
    "position" : 4
  }, {
    "@type" : "SiteNavigationElement",
    "name" : "Resources",
    "position" : 5
  }, {
    "@type" : "SiteNavigationElement",
    "name" : "Support",
    "position" : 6,
    "url" : "https://support.virtru.com"
  }, {
    "@type" : "SiteNavigationElement",
    "name" : "Pricing",
    "position" : 7
  } ],
  "name" : "Main Navigation"
}
```