Updated October 26, 2026
· ~2 min read
DFARS 252.204-7012 requires any cloud provider that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. AWS's commercial US Regions and GovCloud (US) both clear that bar. The difference shows up with export-controlled data, contract language and who may administer the environment.
The cloud provider's authorization covers its side. Your system security plan, the 110 NIST SP 800-171 requirements for your environment, user training, incident reporting within 72 hours and CMMC assessment are still yours. A GovCloud account configured carelessly is not compliant because of where it runs.
Question 1 of 2
Will the environment hold ITAR or EAR export-controlled technical data?
**AWS commercial US Regions:** meet the FedRAMP Moderate requirement for CUI under 7012, with every service and the lowest prices. A reasonable home for CUI that is not export-controlled, when contracts do not require more. **AWS GovCloud (US):** for ITAR and other export-controlled technical data, and for contracts or primes that require it. Accounts only for US persons working for US organizations, AWS personnel access limited to US citizens, FedRAMP High. Fewer services and later feature launches, and its own account and identity setup. Many firms run both: CUI enclave workloads in GovCloud, everything else in commercial Regions.
CMMC Level 2 Enclave on AWS
CMMC Level 2 certification can be required in DoD solicitations from November 10, 2026. We build a scoped enclave for CUI work on AWS GovCloud or commercial US Regions, implement and document the 110 NIST SP 800-171 requirements for it, and get you ready for a C3PAO assessment.
AWS Landing Zone Foundation
Enterprise-grade AWS account structure designed for security, scalability, and compliance from day one.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.