{"id":"F1212191840A","name":"Box Enterprise Cloud Content Collaboration Platform","provider":"Box Inc.","providerSlug":"box-inc","status":"FedRAMP Authorized","impact":"High","authType":"Agency","authDate":"2025-03-25","serviceModel":["PaaS","SaaS"],"deployment":"Public Cloud","businessFunctions":["Collaboration","Communication","Content Management System (CMS)","Data Management","Finance","Grant Management","Human Resources","Legal & Policy","Marketing & Sales","Research"],"assessor":"Schellman Compliance, LLC","assessorId":"136571","smallBusiness":false,"website":"https://www.box.com/","description":"Box is a FedRAMP High, FedRAMP Moderate and DoD IL4 Authorized secure cloud content management, collaboration, and intelligent automation platform that enables federal agencies and the Department of Defense to securely manage, share, and analyze mission-critical content in the cloud.\n\nBuilt to support the rigorous compliance, security, and operational demands of U.S. federal and defense environments, Box provides a unified content platform where agencies can collaborate in real time, manage the full lifecycle of Controlled Unclassified Information (CUI), automate workflows, and maintain full control over sensitive data—whether in civilian, DoD, or Intelligence Community settings.\n\nBox delivers enterprise-grade security with end-to-end encryption, granular access controls, detailed audit trails, and native data governance capabilities—all managed in U.S.-based data centers by U.S. Persons. The platform integrates seamlessly with existing identity providers, zero trust architectures, and endpoint security solutions, supporting CAC/PIV authentication and aligning with NIST 800-53 Rev5, FedRAMP High, and DoD SRG IL4 control baselines.\n\nBoxAI, a secure, built-in suite of enterprise-grade artificial intelligence tools, enhances the power of content by enabling federal teams to summarize documents, extract insights, automate repetitive tasks, and make faster, smarter decisions—without compromising compliance. BoxAI operates entirely within the FedRAMP High boundary, ensuring that government data remains private, is never used to train AI models, and is governed according to strict federal standards.\n\nBox is committed to supporting agencies as they modernize IT operations, drive digital transformation, and accelerate mission outcomes—securely, intelligently, and at scale. With Box for Government and BoxAI, agencies gain the trusted content layer they need to operate with speed, agility, and confidence in today’s dynamic threat landscape.","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/Box%20Logo.png","inMarketplace":true,"agencies":["22-051","22-033","22-075","22-034","22-034-02","22-011-06","22-011-02","22-016-08","22-007","22-007-17","22-007-28","22-007-03","22-007-07","22-007-19","22-005","22-005-09","22-005-02","22-005-06","22-005-01","22-005-08","22-005-11","22-002-04","22-012-01","22-012-02","22-021","22-042","22-017-10","22-017-13","22-017-12","22-017-03","22-027","22-027-06","22-027-01","22-027-09","22-014-02","22-036","22-018","22-091","22-067","22-070","22-082","22-030","22-068","22-025-01","22-023","22-062","22-040","22-044","22-078","22-065","22-060"],"reuseCount":53,"leverages":["F1603047866","FR1805751477"],"leveragedBy":["FR2524349489","FR2104636677"],"timeline":[{"date":"2022-03-24","to":"Agency Authorization In Process","certType":"Rev5"},{"date":"2024-07-30","to":"FedRAMP In Process","certType":"Rev5"},{"date":"2025-03-25","to":"FedRAMP Certified","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no UEI number; include it if you have one","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Schellman Compliance, LLC"},"sponsor":"22-036","trustCenterCheck":null}