Is Box, Dropbox, HubSpot or ChatGPT CMMC Compliant?

By Shaheer Malik · Updated Oct 28, 2026

No software or cloud service is “CMMC compliant”: CMMC statuses belong to your organization’s systems, not to products. The real question is whether a service may hold your CUI, and the rule’s answer is that a cloud provider holding CUI must meet FedRAMP Moderate or equivalent under DFARS 252.204-7012. Box is FedRAMP High authorized; Dropbox, HubSpot and Anthropic’s Claude have no FedRAMP Marketplace listing.^[1][2][3]

FedRAMP status of common tools

From the FedRAMP Marketplace data published by GSA (last changed May 19, 2026).^[3] Authorizations cover the named offering only: commercial versions of the same brand may not be included. Check the live Marketplace before you decide.^[4]

How to read this

• FCI only (Level 1): the rule sets no FedRAMP requirement; any tool can be in scope if you can meet the 15 requirements with it.^[1]
• CUI (Level 2): the provider must meet FedRAMP Moderate or equivalent and DFARS 252.204-7012 paragraphs (c) through (g), and you must “require and ensure” it does.^[2]
• Not listed is not a ban. A provider can show FedRAMP Moderate equivalency another way, but the burden of proof is on you, and the assessor will ask for it.^[2]
• Keep CUI out of tools that can’t hold it. If a CRM, chat tool or AI assistant isn’t authorized, policy and configuration must stop CUI from going in; that is how Contractor Risk Managed Assets are treated in scoping.^[1]

CRMs and AI tools

For a CRM that may hold CUI, the listed options include Salesforce Government Cloud Plus and Dynamics 365 in Azure Government; HubSpot has no listing.^[3] For AI, ChatGPT Enterprise and API Platform has a FedRAMP 20x Moderate authorization; Claude used directly from Anthropic has no listing.^[3] Whether an AI tool may see CUI is your decision to document in the SSP.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

Is Box CMMC compliant?

No product is CMMC compliant, but Box Enterprise Cloud Content Collaboration Platform holds a FedRAMP High authorization, which meets the FedRAMP Moderate requirement for cloud providers holding CUI.

Is Dropbox CMMC compliant?

Dropbox has no FedRAMP Marketplace listing, so storing CUI there would require proving FedRAMP Moderate equivalency yourself. For FCI only, the rule sets no FedRAMP requirement.

Is HubSpot CMMC compliant?

HubSpot has no FedRAMP Marketplace listing. Keep CUI out of it, or use a CRM with a FedRAMP authorization such as Salesforce Government Cloud Plus.

Is Claude CMMC compliant?

Anthropic’s Claude used directly has no FedRAMP Marketplace listing. Don’t put CUI into it unless you can show FedRAMP Moderate equivalency for the way you access it.

Sources

1. 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
2. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
3. FedRAMP Marketplace data, published by GSA (last changed May 19, 2026) (checked Oct 28, 2026)
4. FedRAMP Marketplace: Box Enterprise Cloud Content Collaboration Platform (High) (checked Oct 28, 2026)

More on cloud, tools and enclaves

• Does CMMC Require GCC High? Microsoft 365 Options Compared
• Google Workspace and CMMC: Level 1, Level 2 and Editions
• CMMC Enclave: What It Is, When You Need One, What It Costs
• CMMC Compliance Software: What It Can and Can’t Do