Kiteworks for CMMC: Sharing CUI Safely
Primes, subs, suppliers, and agencies all need files from you. Kiteworks gives you one controlled way to send CUI by email, file share, or automated transfer, and one audit log that shows who touched what. Kiteworks’ team sets it up. Sierra Experts resells it and runs the users and auditing side as a managed service.
- Veteran-Owned
- Headquartered in Pittsburgh
- Kiteworks resale
- Support 24x7
The hard part of CUI is the moment it leaves your company.
Inside Microsoft 365 GCC High, you can keep CUI under tight control. The trouble starts when a drawing has to go to a machine shop, a test report goes back to the prime, or a supplier needs to send you a spec. That traffic tends to end up in personal email, a consumer file-sharing app, or an FTP server nobody has touched in years, and none of those give you the record an assessor will ask for.
Kiteworks puts those exchanges on one platform: secure email, file sharing, managed file transfer, SFTP, and secure web forms, with FIPS 140-3 Level 1 validated encryption, least-privilege access, and a single audit log across every channel.
It is one part of our CMMC & GCC Compliance offering, alongside ThreatLocker on every device, Microsoft 365 GCC or GCC High, and managed support.
Problems it solves
Start with how CUI moves in and out of your company today. Each of these is a common gap.
Where CMMC stands: CMMC Phase 2 certifications are on hold as of July 2026, but Phase 1 self-assessments and DFARS 252.204-7012 still require you to protect the CUI you send and receive. Kiteworks is how you show where that CUI went.
Emailing CUI to outside parties
Send encrypted messages and attachments to primes, subs, and suppliers from Outlook or the web, under policies you set, instead of plain email or personal accounts.
Large and automated transfers
Managed file transfer and SFTP handle big files and scheduled, policy-driven jobs, so the old FTP server and homegrown scripts can be retired.
Collecting files from outside
Secure web forms let customers and partners submit files and data to you without email attachments or shared links you can’t track.
Proving it at assessment time
One audit log covers email, file sharing, MFT, SFTP, and forms, and Kiteworks logs configuration changes too. Logs can feed your SIEM.
Sharing without giving up the file
Kiteworks’ next-gen DRM, SafeEDIT, lets an outside party view and edit a document without taking possession of the file.
Fitting the tools you have
Kiteworks integrates with LDAP and Active Directory, SIEM, DLP, advanced threat protection, and content disarm and reconstruction (CDR) tools.
Where it fits with GCC High and ThreatLocker
Kiteworks doesn’t replace Microsoft 365. It covers the part Microsoft 365 GCC High makes harder: exchanging CUI with people outside your tenant.
Microsoft 365 GCC or GCC High handles…
- Internal email, Teams, and files
- Identity, MFA, and access policies for your users
- Where your CUI is stored day to day
Kiteworks handles…
- CUI sent to and received from outside parties
- Large files, automated transfers, and SFTP
- Secure web forms for inbound files and data
- One audit log for all of those exchanges
Kiteworks protects CUI on the way in and out. ThreatLocker protects the computers it lands on. ThreatLocker is zero trust on every endpoint: only approved software runs, approved apps only reach what they need, and Storage Control decides which USB drives can connect and whether they can copy files. It’s where we start CMMC projects. We search and review the ThreatLocker audit log weekly for fully managed clients, and daily for co-managed environments. Add Duo Federal for MFA, NinjaOne for Government for patching, and our 24x7 support, and you have the full CMMC & GCC Compliance plan.
Deployment options
Kiteworks runs as a private, single-tenant instance in every option. We help you pick the one your contracts and team can support.
On-premises
A hardened virtual appliance in your own environment. The most control, and the most responsibility for infrastructure.
Kiteworks hosted
A single-tenant, hardened instance hosted and managed by Kiteworks, with backup, monitoring, and an availability SLA.
FedRAMP hosted
Kiteworks Federal Cloud is FedRAMP Moderate authorized, with screened U.S.-based support personnel and annual third-party assessments. Kiteworks also supports FedRAMP High deployments in AWS GovCloud, with FedRAMP High authorization in process.
How Sierra Experts helps: Kiteworks reseller and Kiteworks Managed Service
Kiteworks’ team installs and sets up the platform. We resell it, coordinate the rollout, and handle the day-to-day through our Kiteworks Managed Service: adding and removing users, managing access, and pulling the activity logs and reports your assessor asks for.
Our role: Kiteworks’ team installs, configures, and supports the platform. Sierra Experts resells Kiteworks, coordinates the rollout with the rest of your environment, and manages it from there: user onboarding and offboarding, access and permissions, and audit log reviews and reports. Kiteworks’ FedRAMP authorization and FIPS validation belong to Kiteworks. Kiteworks supports your CMMC evidence for sharing CUI; it doesn’t make you compliant on its own, and Sierra Experts doesn’t certify.
Scope
Who you exchange CUI with, how it moves today, which channels you need, and which deployment fits your contracts.
License
We size Kiteworks to the people who actually exchange CUI and the features you need, then quote it. No guesswork on seat counts.
Coordinate
Kiteworks’ team handles installation and configuration. We line up what it touches on our side: your Microsoft 365 tenant, directory, network, and the users who need access.
Managed service: keep you audit-ready
We add and remove users, manage access and permissions, review the audit log, and pull activity reports for your assessor or prime. We support the environment around Kiteworks 24x7 and work with Kiteworks support on platform issues.
Frequently asked questions
What is Kiteworks?
Kiteworks is a platform for exchanging sensitive files and email with people outside your company. Secure email, file sharing, managed file transfer (MFT), SFTP, and secure web forms run on one platform with one set of policies and one audit log.
Is Kiteworks FedRAMP authorized?
Kiteworks is FedRAMP Moderate authorized: Kiteworks Federal Cloud is listed as authorized on the FedRAMP Marketplace. Kiteworks also supports FedRAMP High deployments in AWS GovCloud, with FedRAMP High authorization in process, so it isn’t High authorized yet. On-premises and Kiteworks-hosted deployments are available too. We help you choose the option that matches your contracts.
Does Kiteworks make us CMMC compliant?
No single product does that. Kiteworks says its platform supports 90% of CMMC Level 2 requirements. The rest depends on your policies, your people, and your other systems, which is why we pair it with Microsoft 365 GCC or GCC High, ThreatLocker, and managed support.
Does Kiteworks secure email work with Outlook?
Yes. Kiteworks secure email works on the web, on mobile, and in Outlook, and Kiteworks says its end-to-end email encryption works with standard email clients without plug-ins.
Can Kiteworks replace our old FTP server?
Yes. Kiteworks includes SFTP and managed file transfer with scheduled, policy-driven transfers, so file exchanges that run on an old FTP server or scripts can move onto the same platform and the same audit log.
Which CMMC requirements does Kiteworks help with?
Kiteworks supports requirements around controlling the flow of CUI, access control, audit logging, and encrypting CUI with FIPS-validated encryption, for the email and files you exchange with outside parties, with one audit log for all of it. It’s one piece of your security plan, not all of it.
Do we still need Kiteworks if we are on GCC High?
Usually, yes. GCC High protects CUI inside your company. Kiteworks covers the part GCC High wasn’t built for: sending and receiving CUI with primes, subs, and suppliers who aren’t on GCC High, and showing where each file went. For GCC High tenants, ask us about Kiteworks’ FedRAMP High deployment in AWS GovCloud, which has FedRAMP High authorization in process.
What does the Kiteworks Managed Service include?
Kiteworks’ team installs and sets up the platform. Our Kiteworks Managed Service handles the day-to-day: adding and removing users, managing access and sharing policies, and pulling the activity logs and reports your assessor or prime asks for.
How do we buy Kiteworks?
Through us. We size Kiteworks to the people who actually exchange CUI with outside parties, the features you need, and the deployment you choose, then quote it. Kiteworks’ team handles installation and setup, we coordinate the rollout, and our Kiteworks Managed Service covers users, access, and audit reports from there.
Related services
Last reviewed October 28, 2026
Kiteworks product details on this page come from kiteworks.com, Kiteworks’ account team, and the FedRAMP Marketplace (October 2026). Kiteworks is a trademark of Kiteworks USA, LLC. ThreatLocker is a registered trademark of ThreatLocker, Inc. NinjaOne is a trademark of NinjaOne, LLC. Cisco and Duo are trademarks or registered trademarks of Cisco and/or its affiliates. This page is general guidance, not legal or compliance advice. Sierra Experts does not certify CMMC compliance. Confirm your requirements with your compliance or legal advisors.
Need a safe way to share CUI? Let’s map it out.
Tell us who you exchange files with and how it happens today, and we’ll show you what Kiteworks would look like for your company. Sierra Experts is a veteran-owned IT company headquartered in Pittsburgh, supporting customers in 38 states and 3 countries. Our team includes enlisted U.S. Air Force veterans and current service members, some holding applicable security clearances. Call 412.722.0707 or send us a note.
Talk to an engineer
Tell us what you are working on and a Sierra Experts engineer will get back to you. The first consultation is free.
- Call sales412.722.0707
- Pick a timeBook a meeting with Mark Sokolowski