Independent evaluation by FedRAMP-recognized 3PAO confirms ProShop’s AWS GovCloud hosting environment meets the FedRAMP Moderate baseline (NIST SP 800-53), as required under DFARS 252.204-7012 — the cloud security obligation the Department of War reaffirmed when it suspended CMMC Phase II on July 13.
BELLINGHAM, WA — July 20, 2026 — ProShop, the leading system of execution for precision manufacturers, today announced it has completed an independent assessment of its cloud hosting environment on AWS GovCloud against the FedRAMP Moderate baseline. The assessment was conducted by RiscPoint, an accredited Third-Party Assessment Organization (3PAO) recognized by the FedRAMP program, evaluating ProShop’s implementation of the FedRAMP Moderate baseline control set.
The announcement comes at a pivotal moment for defense manufacturers. On July 13, 2026, the Department of War suspended CMMC Phase II, the enforcement mechanism that would have mandated third-party certification assessments in contracts beginning this November. However, the same release that paused Phase II explicitly reaffirmed DFARS 252.204-7012, the contracting clause that requires defense contractors to protect Controlled Unclassified Information (CUI).
That clause – not CMMC – is what requires any cloud service provider storing CUI to meet the FedRAMP Moderate security baseline or its equivalent, and compliance remains an immediate requirement. ProShop’s latest assessment was engineered to address this specific standard directly.
“For the average 30-person machine shop, building a hosting environment that meets the FedRAMP Moderate baseline from scratch is extremely difficult and prohibitively expensive,” said Jen Busenbark, ProShop’s vice president of product. “We built this so they don’t have to. Our customers can now store, process, and transmit CUI inside a platform that has been independently assessed to meet the same security standard the federal government requires of its own cloud providers.”
Why This Matters for Machine Shops — Especially Now
Under DFARS 252.204-7012, defense contractors using cloud service providers must ensure those providers meet security requirements equivalent to the FedRAMP Moderate baseline. Per DoW guidance, “equivalency” demands full implementation of controls validated by a certified 3PAO.
This regulatory landscape impacts machine shops in three critical ways:
- ERP Vulnerability: ERP systems are the primary repository for CUI — including engineering drawings, work orders, inspection records, routing sheets, and job travelers. If that ERP is not hosted in an environment that meets the FedRAMP Moderate baseline, the shop’s entire compliance boundary fails.
- Shift to Self-Attestation: With CMMC Phase II paused, Phase I self-assessments remain the standard. Contractors must maintain accurate SPRS scores and submit annual affirmations of compliance.
- Active DIBCAC Enforcement: The DoW continues to audit contractor cybersecurity at any time through the Defense Contract Management Agency’s DIBCAC division, meaning a defensible compliance strategy is non-negotiable.
ProShop’s independently assessed AWS GovCloud environment directly addresses this by providing a hosting environment that meets the DFARS security requirement, purpose-built for defense manufacturing workflows.
What This Means for Prime Contractors
Prime contractors bear responsibility for ensuring their supply chains can protect CUI. Primes have spent years embedding cybersecurity requirements into subcontracts — requirements that frequently exceed the DoW floor. A 60-day reform study does not change their flow-down language. If anything, the suspension of third-party certification shifts more scrutiny onto primes to verify their suppliers’ compliance posture through other means.
“Primes don’t want to manage their suppliers’ cybersecurity programs,” said Paul Beavers, ProShop’s chief technology officer. “They want to see that the systems their suppliers use have already been independently assessed. An environment that’s been evaluated against the FedRAMP Moderate baseline by a recognized 3PAO gives primes a clear signal that CUI is being handled in an environment built to the right standard.”
ProShop’s FedCloud defense-grade cloud hosting is designed to let customers inherit or share a significant portion of the NIST SP 800-171 Rev 2 controls that underpin CMMC Level 2, substantially reducing the compliance work that falls on the shop itself. ProShop provides each customer a Customer Responsibility Matrix that identifies, control by control, what ProShop delivers, what is shared, and what remains the customer’s responsibility, so shops can complete their self-assessment and SPRS scoring against a clear, documented baseline.
If you are a machine shop trying to understand where your CUI environment stands, ProShop has set up a free self-assessment at https://cui.proshoperp.com/
About ProShop ERP
ProShop is the system of execution built exclusively for precision machine shops. Trusted by more than 700 manufacturers across aerospace, defense, medical, and energy, ProShop helps shops capture institutional knowledge, uphold compliance on the floor, and run more predictably — without depending on who happens to be there. ProShop is headquartered in Bellingham, Washington.
For more information, visit proshoperp.com or explore ProShop’s CMMC compliance resources.
ProShop ERP is not FedRAMP Authorized and holds no FedRAMP designation. “FedRAMP Moderate baseline” refers to the NIST SP 800-53 Moderate control set; it is used here as a technical reference, not as a claim of FedRAMP status. ProShop has undergone an independent third-party assessment of its security controls against the FedRAMP Moderate baseline by RiscPoint, a FedRAMP-recognized 3PAO, to support the DFARS 252.204-7012 cloud security requirement and customer CMMC compliance programs. This assessment does not constitute FedRAMP authorization, certification, or endorsement by the FedRAMP program, the General Services Administration, or any federal agency.