Skip to main content
Box Drive can run in FedRAMP mode, in which it meets the requirements for FedRAMP Certified, Class D (formerly FedRAMP High Authorized), and for any lower class. As an admin, you configure the operating system, install a current version of Box Drive, enable FedRAMP mode on each computer, and confirm that your users only work with certified features. These settings live on the computer itself. The Box service does not store them, and you cannot configure them from Box account settings or the Box Admin Console.

​
Operating system requirements

​
FIPS-validated cryptography

Choose a version of Microsoft Windows or Apple macOS that provides FIPS 140-2 or FIPS 140-3 validated cryptography, then configure and use it according to the vendor’s security policy document. Both vendors publish their validations:

​
Cipher negotiation

Make sure the cryptographic modules that the operating system provides negotiate only FIPS-validated ciphers. Windows gives you explicit controls for this. macOS does not. On macOS, Apple requests AES-GCM cipher negotiation at a higher priority than ciphers that are not FIPS-approved. Box Drive depends on that ordering, so confirm that every version of macOS you deploy behaves this way. Until Apple provides explicit controls, validate the behavior with a network capture each time you update the operating system.

​
Encryption at rest

To meet encryption-at-rest requirements, enable full-disk encryption, such as BitLocker on Windows or FileVault on macOS. Box Drive relies on the operating system for this protection, because it does not encrypt content on the computer itself.

​
Default browser

Box Drive opens the default web browser for some tasks, including login. Make sure the default browser on each computer meets your own compliance requirements.

​
Box Drive version and updates

Install the most recent version of Box Drive. FedRAMP mode requires Box Drive 2.39 or later, but treat 2.39 as the minimum rather than the version to deploy, because later releases include newer security patches. Accept and install updates when Box Drive prompts you. Updates carry the security patches that keep Box Drive compliant.

​
Enabling FedRAMP mode

Box Drive does not enter FedRAMP mode until you restart the computer. Until then, Box Drive keeps working normally but does not meet FedRAMP requirements.
A registry value controls FedRAMP mode. Set it per machine so that it covers everyone who uses the computer, or per user if you need to enable the mode selectively. Per machine is the recommended scope.
  1. In Registry Editor, go to the key for the scope you want:
    • Per machine (recommended): HKEY_LOCAL_MACHINE\Software\Box\Box
    • Per user: HKEY_CURRENT_USER\Software\Box\Box
  2. Add a DWORD value named FedRampMode and set it to 1.
  3. Restart the computer.
To turn off FedRAMP mode, delete the FedRampMode value and restart the computer.

​
Features not certified for FedRAMP

Not every Box Drive feature is certified for FedRAMP. Before you deploy, check with your Box account team that every feature you plan to use is certified for the class you need. Currently, Apple iWork collaborative editing is not certified at any FedRAMP class. To keep users from reaching this feature by accident, disable the corresponding integration in the Box Admin Console. For more information, see application settings for your enterprise.
Last modified on September 2, 2026