ProShop completes FedRAMP Moderate assessment for GovCloud hosting

ProShop says its AWS GovCloud environment has completed an independent assessment against the FedRAMP Moderate baseline, a step aimed at defense manufacturers that must protect Controlled Unclassified Information under DFARS. The move comes as CMMC Phase II is paused but the underlying cloud security requirement for CUI remains in force.

Why it matters: - Defense manufacturers still need a cloud environment that can protect Controlled Unclassified Information, even after the pause of CMMC Phase II. - ProShop says its independently assessed hosting is designed to help machine shops meet the FedRAMP Moderate-equivalent security requirement tied to DFARS 252.204-7012. - The assessment may reduce the compliance burden for shops that rely on ERP systems to store engineering drawings, work orders, inspection records, routing sheets, and job travelers.

What happened: - ProShop completed an independent assessment of its cloud hosting environment on AWS GovCloud against the FedRAMP Moderate baseline. - RiscPoint, an accredited Third-Party Assessment Organization recognized by the FedRAMP program, conducted the assessment. - The review evaluated ProShop's implementation of the FedRAMP Moderate baseline control set. - ProShop announced the assessment on July 20, 2026, from Bellingham, Washington.

The details: - The company framed the assessment around DFARS 252.204-7012, which requires defense contractors to protect Controlled Unclassified Information. - The announcement followed the Department of War's July 13, 2026 decision to suspend CMMC Phase II, while reaffirming DFARS 252.204-7012. - ProShop said the relevant requirement is not CMMC itself, but the cloud security standard that applies to any provider storing CUI. - Jen Busenbark, ProShop's vice president of product, said building a FedRAMP Moderate-aligned hosting environment from scratch is difficult and expensive for a typical 30-person machine shop. - ProShop said customers can store, process, and transmit CUI inside the assessed platform. - The company said its FedCloud hosting is designed to help customers inherit or share a significant portion of the NIST SP 800-171 Rev. 2 controls that underpin CMMC Level 2. - ProShop provides each customer a Customer Responsibility Matrix that breaks down which controls ProShop delivers, which are shared, and which remain the customer's responsibility. - ProShop included a free self-assessment at the company's CUI check. - ProShop says it serves more than 700 manufacturers across aerospace, defense, medical, and energy. - The company is headquartered in Bellingham, Washington.

Between the lines: - The pause of third-party certification does not remove scrutiny from defense suppliers; it shifts more responsibility to primes and contractors to prove their compliance posture. - ProShop is positioning its hosting as a ready-made compliance layer for shops that do not want to build and validate that environment on their own. - Paul Beavers, ProShop's chief technology officer, said primes want evidence that supplier systems have already been independently assessed. - The company is also signaling that independent validation may matter more than self-attestation as contractors continue to face audits through the Defense Contract Management Agency's DIBCAC division.

What's next: - Machine shops using or evaluating ProShop can use the free self-assessment to gauge their CUI environment. - Prime contractors are likely to keep pressing suppliers for proof that cloud systems handling CUI meet the relevant baseline. - ProShop's assessment gives the company a basis to market FedCloud as a defense-grade option for shops seeking a clearer compliance path.

The bottom line: - ProShop is betting that an independently assessed GovCloud environment will become a practical shortcut for defense manufacturers that need to meet CUI security requirements without building the infrastructure themselves.