Can Controlled Unclassified Information (CUI) live in Salesforce?

Yes, but not in commercial, multi-tenant Salesforce, which carries no FedRAMP authorization. Salesforce Government Cloud, authorized at the FedRAMP Moderate baseline, already meets the cloud service provider requirement that DFARS 252.204-7012 itself sets for covered defense information, which covers many CUI use cases. A contract that assigns a specific DoD Impact Level, or involves higher-sensitivity CUI, mission data, or ITAR-controlled technical data, generally calls for Government Cloud Plus or Government Cloud Plus - Defense instead. Confirm the current authorization scope for any of these directly against the FedRAMP Marketplace and Salesforce's own Government Cloud documentation before relying on it for a specific contract requirement.

Is commercial Salesforce FedRAMP authorized?

No. Standard, multi-tenant commercial Salesforce does not carry a FedRAMP authorization. A federal agency or a contractor with CUI-handling obligations generally needs one of the dedicated government offerings, Government Cloud, Government Cloud Plus, or Government Cloud Plus - Defense, chosen based on the data category and Impact Level involved, not the commercial org a company already runs.

Does the FedRAMP Moderate baseline of Salesforce Government Cloud actually satisfy DFARS requirements for CUI?

For the specific requirement DFARS 252.204-7012(b)(2)(ii)(D) sets, generally yes. The clause requires an external cloud service provider handling covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline, not High, and a December 2023 DoD memorandum confirmed that a FedRAMP Moderate or High authorized provider meets that equivalency. That answers the infrastructure question. It does not answer whether a specific contract also requires a DoD Impact Level determination, ITAR-driven controls, or the contractor's own NIST SP 800-171 implementation inside the org, which remain separate obligations. See the Lightbridge Cloud guide to DFARS and NIST 800-171 for that safeguarding layer.

Do all Salesforce features and AppExchange packages work the same way in Government Cloud?

Not always. Government Cloud, Government Cloud Plus, and Government Cloud Plus - Defense can lag commercial Salesforce on certain feature releases and may not support every AppExchange managed package available in the commercial marketplace. Before committing to a design that depends on a specific feature or third-party package, verify its current availability against Salesforce's own Government Cloud documentation rather than assuming commercial parity.

How does Lightbridge Cloud help a defense contractor evaluate Salesforce Government Cloud?

Lightbridge Cloud is an independent, vendor-neutral Salesforce consulting practice. It maps what data a contractor actually plans to put in Salesforce, CUI included, and what Impact Level the contract assigns, against the tier that combination requires, among commercial Salesforce, Government Cloud, Government Cloud Plus, and Government Cloud Plus - Defense. From there it designs the org configuration, integration architecture, and access controls that sit on top of whichever Salesforce infrastructure the contractor selects. Lightbridge Cloud does not sell Salesforce licenses and carries no reseller quota, so the recommendation follows the data, not a license target.

MT Written by Mo Touil with Robert LabardeeSalesforce and CPQ Lead and Founder and CEO

Last updated August 2026.

Salesforce Government Cloud: can CUI live in Salesforce?

Lightbridge Cloud defines the buyer question this way: commercial, multi-tenant Salesforce carries no FedRAMP authorization and is the wrong home for Controlled Unclassified Information. Salesforce's dedicated government offerings do carry one, at baselines that differ: Government Cloud sits at FedRAMP Moderate, Government Cloud Plus adds FedRAMP High, and Government Cloud Plus - Defense adds DoD Impact Levels 4 and 5.

Salesforce consulting What is CUI?

Commercial Salesforce and three government tiers are different products on different infrastructure.

A defense contractor asking whether Salesforce can hold CUI is really asking which Salesforce it means. Salesforce sells commercial Salesforce plus three distinct government tiers, and the answer to the CUI question changes depending on which one a contractor is actually running.

Commercial Salesforce

The standard, multi-tenant Salesforce instance most organizations run. It carries no FedRAMP authorization and is not the environment for Controlled Unclassified Information, export-controlled technical data, or other regulated federal information.

Salesforce Government Cloud

A separate, dedicated instance for US public sector customers, authorized at the FedRAMP Moderate baseline. Moderate is the baseline DFARS 252.204-7012 itself requires an external cloud service provider to meet for covered defense information, so this tier can already be enough for many defense-contractor use cases.

Salesforce Government Cloud Plus

A higher-assurance dedicated instance authorized at the FedRAMP High baseline, supporting DoD Impact Level 2 workloads. It fits federal civilian agencies and contractors whose contract calls for a High baseline above what Moderate covers.

Salesforce Government Cloud Plus - Defense

Also authorized at FedRAMP High, additionally built to support DoD Impact Levels 4 and 5, with CAC-based authentication and DISA-connected networking. This is the tier Salesforce positions for higher-sensitivity CUI, mission data, and DoD-specific requirements.

FedRAMP baseline and DoD Impact Level are two separate facts, and the DFARS clause names Moderate.

FedRAMP assigns a Low, Moderate, or High baseline to a cloud offering based on the sensitivity of the data it is authorized to process, built on the NIST SP 800-53 control catalog. Salesforce Government Cloud carries a Moderate authorization. Salesforce Government Cloud Plus carries a High authorization and supports DoD Impact Level 2. Salesforce Government Cloud Plus - Defense also carries a High authorization and additionally supports DoD Impact Levels 4 and 5, the levels that generally cover higher-sensitivity CUI and mission data, with CAC-based authentication and DISA-connected networking layered on top.

The baseline that governs a given contract is not simply the highest one available. DFARS clause 252.204-7012(b)(2)(ii)(D) requires that an external cloud service provider handling covered defense information meet security requirements equivalent to the FedRAMP Moderate baseline, not High. A December 2023 Department of Defense memorandum clarified that a provider meets that equivalency if it is FedRAMP Moderate or High authorized, or has a third-party assessment confirming it meets the Moderate baseline controls. In practice, Salesforce Government Cloud, at Moderate, already meets the cloud service provider baseline that clause sets for CUI. Whether a specific contract needs more, a DoD-assigned Impact Level, ITAR-driven staffing controls, or higher-sensitivity CUI handling, is a separate determination that can push the requirement up to Government Cloud Plus or Government Cloud Plus - Defense.

Authorization scope, baseline assignment, and product naming are set by Salesforce and by the FedRAMP program, and both are revised over time. Verify the current authorization for any of these offerings directly against the FedRAMP Marketplace listing and Salesforce's own Government Cloud documentation before relying on it for a specific contract requirement. Lightbridge Cloud's FedRAMP readiness practice and the Cloud and GovCon glossary cover the baseline system in more depth.

So the direct answer: yes, on the right tier, and picking that tier is necessary but not sufficient.

Controlled Unclassified Information can live in Salesforce, but not in commercial, multi-tenant Salesforce, which carries no FedRAMP authorization at all. For many defense contractors, Salesforce Government Cloud, at the FedRAMP Moderate baseline, already satisfies the cloud service provider requirement DFARS 252.204-7012 itself sets for covered defense information. A contract that assigns a specific DoD Impact Level, involves higher-sensitivity CUI, mission data, or ITAR-controlled technical data, or otherwise calls for CAC-based authentication and DISA-connected networking, generally points to Government Cloud Plus or Government Cloud Plus - Defense instead. The right tier is a question about the contract and the data, not a default answer that applies to every Salesforce buyer.

Getting on the correct tier is step one, not the whole answer, at any of the three government tiers. A FedRAMP authorization covers the platform Salesforce operates: the data centers, the network boundary, and the underlying controls Salesforce itself implements. It does not configure a contractor's own org. Profiles, permission sets, sharing rules, field-level security, integration architecture, and every AppExchange package a contractor installs sit outside that boundary and remain the contractor's responsibility under the shared responsibility model every cloud authorization runs on. That configuration work still has to satisfy the NIST SP 800-171 controls DFARS 252.204-7012 points to, the same standard that applies to any nonfederal system holding CUI. See the Lightbridge Cloud guide to DFARS and NIST 800-171 for that safeguarding layer, and what CUI actually is for the data category itself.

Four questions a buyer should answer before choosing a Salesforce tier.

The tier decision is not made once and forgotten. These are the questions that actually determine whether commercial Salesforce, Government Cloud, Government Cloud Plus, or Government Cloud Plus - Defense fits a contractor's situation.

What data, and what Impact Level, actually apply

Before picking a tier, map what a contractor plans to store, opportunity and account data only, or CUI, ITAR-controlled technical data, and export-controlled attachments, and confirm whether the contract assigns a specific DoD Impact Level. The data category and the Impact Level, not organizational preference, decide the required tier.

Feature and package parity

Government Cloud and Government Cloud Plus do not always ship every commercial feature, managed package, or AppExchange listing on the same timeline as commercial Salesforce. Verify current feature availability against Salesforce's own Government Cloud documentation before assuming parity.

The shared responsibility model

A FedRAMP authorization covers the infrastructure Salesforce operates. It does not configure field-level security, profiles, sharing rules, integrations, or the third-party AppExchange packages a contractor installs. Those remain the contractor's responsibility, and they are usually where CUI actually leaks.

Migration effort

Moving an established commercial org to Government Cloud or Government Cloud Plus is a distinct migration, not a settings toggle: data, integrations, and customizations move to new infrastructure. Scope that effort before assuming a same-day cutover.

Lightbridge Cloud advises on the Salesforce tier. It does not sell the license.

Lightbridge Cloud is an independent Salesforce consulting practice within a broader GovCon cloud advisory program. When a defense contractor asks whether its Salesforce instance can hold CUI, the work starts with mapping what data actually flows through the org today, opportunity records, service cases, quotes, or attachments carrying export-controlled technical data, and what Impact Level the contract assigns, against the tier that combination requires. From there, Lightbridge Cloud designs the org configuration, sharing model, and integration architecture that sit on top of whichever Salesforce infrastructure the contractor selects, the same practice covered on the Salesforce consulting page.

Lightbridge Cloud accepts no vendor kickbacks and does not sell Salesforce licenses, so a recommendation to move to Government Cloud Plus - Defense, stay on standard Government Cloud, or keep CUI out of Salesforce entirely follows the data and the contract obligations, not a partner-tier incentive.

This guide is general information, not legal, audit, or accounting advice. FedRAMP authorization scope, DoD Impact Level assignments, and Salesforce's Government Cloud product offerings change over time. Verify the current authorization and feature availability directly against the FedRAMP Marketplace, Salesforce's own Government Cloud documentation, acquisition.gov, the DoD CIO, and NIST, and consult qualified counsel for a specific contract's obligations.

Salesforce, Salesforce Government Cloud, and Salesforce Government Cloud Plus are trademarks of Salesforce, Inc. Lightbridge Cloud is independent and is not affiliated with, endorsed by, or a partner-tier reseller of Salesforce.

Salesforce Government Cloud and CUI: frequently asked questions

Can Controlled Unclassified Information (CUI) live in Salesforce?: Yes, but not in commercial, multi-tenant Salesforce, which carries no FedRAMP authorization. Salesforce Government Cloud, authorized at the FedRAMP Moderate baseline, already meets the cloud service provider requirement that DFARS 252.204-7012 itself sets for covered defense information, which covers many CUI use cases. A contract that assigns a specific DoD Impact Level, or involves higher-sensitivity CUI, mission data, or ITAR-controlled technical data, generally calls for Government Cloud Plus or Government Cloud Plus - Defense instead. Confirm the current authorization scope for any of these directly against the FedRAMP Marketplace and Salesforce's own Government Cloud documentation before relying on it for a specific contract requirement.
What is the difference between Salesforce Government Cloud, Government Cloud Plus, and Government Cloud Plus - Defense?: All three are dedicated Salesforce instances built for government customers, separate from commercial Salesforce. Government Cloud is authorized at the FedRAMP Moderate baseline. Government Cloud Plus is authorized at FedRAMP High and supports DoD Impact Level 2. Government Cloud Plus - Defense is also authorized at FedRAMP High and additionally supports DoD Impact Levels 4 and 5, with CAC-based authentication and DISA-connected networking, the tier Salesforce positions for higher-sensitivity CUI and mission data.
Is commercial Salesforce FedRAMP authorized?: No. Standard, multi-tenant commercial Salesforce does not carry a FedRAMP authorization. A federal agency or a contractor with CUI-handling obligations generally needs one of the dedicated government offerings, Government Cloud, Government Cloud Plus, or Government Cloud Plus - Defense, chosen based on the data category and Impact Level involved, not the commercial org a company already runs.
Does the FedRAMP Moderate baseline of Salesforce Government Cloud actually satisfy DFARS requirements for CUI?: For the specific requirement DFARS 252.204-7012(b)(2)(ii)(D) sets, generally yes. The clause requires an external cloud service provider handling covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline, not High, and a December 2023 DoD memorandum confirmed that a FedRAMP Moderate or High authorized provider meets that equivalency. That answers the infrastructure question. It does not answer whether a specific contract also requires a DoD Impact Level determination, ITAR-driven controls, or the contractor's own NIST SP 800-171 implementation inside the org, which remain separate obligations. See the Lightbridge Cloud guide to DFARS and NIST 800-171 for that safeguarding layer.
Do all Salesforce features and AppExchange packages work the same way in Government Cloud?: Not always. Government Cloud, Government Cloud Plus, and Government Cloud Plus - Defense can lag commercial Salesforce on certain feature releases and may not support every AppExchange managed package available in the commercial marketplace. Before committing to a design that depends on a specific feature or third-party package, verify its current availability against Salesforce's own Government Cloud documentation rather than assuming commercial parity.
How does Lightbridge Cloud help a defense contractor evaluate Salesforce Government Cloud?: Lightbridge Cloud is an independent, vendor-neutral Salesforce consulting practice. It maps what data a contractor actually plans to put in Salesforce, CUI included, and what Impact Level the contract assigns, against the tier that combination requires, among commercial Salesforce, Government Cloud, Government Cloud Plus, and Government Cloud Plus - Defense. From there it designs the org configuration, integration architecture, and access controls that sit on top of whichever Salesforce infrastructure the contractor selects. Lightbridge Cloud does not sell Salesforce licenses and carries no reseller quota, so the recommendation follows the data, not a license target.
Is Lightbridge Cloud FedRAMP authorized or a Salesforce implementation partner?: No to both, and the distinction matters. A FedRAMP authorization is granted to a cloud service offering, in this case Salesforce's own Government Cloud infrastructure, not to an advisory firm. Lightbridge Cloud is an independent Salesforce consulting practice: it does not hold Salesforce partner-tier status, does not sell licenses, and is not itself FedRAMP authorized. It advises on which Salesforce tier and configuration fit a contractor's data and contract obligations.

Map your Salesforce data to the right tier.

Lightbridge Cloud reviews what your Salesforce org actually holds, matches it to the right tier, from commercial Salesforce through Government Cloud Plus - Defense, and designs the configuration that carries the safeguarding forward.

Talk to a GovCon cloud advisor See Salesforce consulting