FedRAMP Trust Center
Public FedRAMP information for the M-Files federal cloud offering: what the service is, what is in scope, who to contact, and how federal agencies obtain certification data.
Everything on this page is generated from a single machine-readable file that conforms to the FedRAMP Certification Package Overview JSON schema. Last updated —.
General information CDS-CSO-PUB
Who to contact
Security questions and vulnerability reports go to the security contact. Procurement, pricing and demonstrations go to public sector sales.
Services and scope CDS-CSO-SVC
| Service | Description | Scope | Available |
|---|
Services we build on MAS-CSO-TPR
FedRAMP-certified
Services that hold their own FedRAMP certification and from which M-Files inherits controls.
| Service / FedRAMP ID | How M-Files uses it |
|---|
Not FedRAMP-certified
Disposition of each is a public commitment: keep with justification, replace with an in-boundary alternative, or remove.
| Service | Use and disposition |
|---|
Path to certification MKT-IIP-DCP
Milestones are set and measured by M-Files and refreshed at least quarterly. Last updated —. Next scheduled update: —.
What M-Files has committed to FedRAMP
Intended use: Direct Use MKT-IIP-AGU
The M-Files federal cloud offering is intended for Direct Use: it will be used directly by federal agency customers for integration into federal information systems within the scope of 44 U.S.C. § 3506, and each agency deployment will receive an agency Authorization to Operate. Target agency use cases include records digitization and management, grants and FOIA case files, and NARA-aligned records retention.
Independent assessment MKT-IIP-DLA
M-Files commits to scheduling a FedRAMP 20x Class C independent assessment with a FedRAMP Recognized assessment service within two years of its initial Marketplace listing. Planned start: second half of 2027. Outer deadline: two years from the listing date. The assessor will be named here once contracted.
Progress reporting MKT-IIP-DCP
Progress against the milestones above is measured by M-Files and republished at least quarterly. Tracker last updated —; next update —. Milestone dates are targets, not guarantees, and may move as architecture and assessment scheduling firm up.
Documentation and repositories CDS-CSO-IRP
Where certification data lives, what each location holds, and whether sign-in is required. The policy and procedure index (name, version, last updated, word count, related FedRAMP Practices) is published in the authenticated tier.
How to obtain FedRAMP certification data
Public information
This page requires no sign-in and is regenerated whenever the underlying data changes.
Machine-readable data
The JSON used to build this page is served at https://www.m-files.com/fedramp/cpo.json and validates against the FedRAMP Certification Package Overview schema (2026-06-24). Programmatic access to all certification data is documented in the trust center API reference.
Full certification package
View the JSON source for this page
Common questions
Is M-Files FedRAMP certified today?
Not yet. M-Files is listed in the FedRAMP Marketplace in the Initial Implementation Phase and is pursuing a FedRAMP 20x Class C certification. Certification follows an independent assessment by a FedRAMP Recognized assessor; the target date is shown on the progress tracker above.
What does “20x Class C” mean?
FedRAMP 20x is the modernized certification model introduced in the Consolidated Rules for 2026. Class C is the certification class for common enterprise services handling information at the Moderate security category, replacing the former “FedRAMP Moderate” designation.
Which M-Files capabilities will be covered?
See the public service list above. Items marked “In scope” are part of the planned certification boundary; items marked “Pending” are under evaluation and will be confirmed before the certification package is submitted.
How is the existing commercial M-Files Cloud different?
The federal offering is hosted in Microsoft Azure Government within a dedicated FedRAMP boundary, with US-based operations personnel and separate identity, monitoring and deployment pipelines. Commercial M-Files Cloud remains a separate offering.
Working on a federal deployment?
Talk to the M-Files public sector team about timelines, the Customer Responsibility Matrix, and how agencies can prepare an ATO against the forthcoming certification.
Contact public sector sales Request package access