> ## Documentation Index
> Fetch the complete documentation index at: https://docs.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Box Tools for FedRAMP compliance

<div className="article_labels_list" style={{display: 'none'}} dangerouslySetInnerHTML={{__html: "Box Tools , Admin , Security , Compliance , Article , New , Instruction , Desktop - Windows , Desktop - macOS , P2"}} />

Box Tools can run in FedRAMP mode, in which it meets the requirements for FedRAMP Certified, Class D (formerly FedRAMP High Authorized), and for any lower class. As an admin, you configure the operating system, install a current version of Box Tools, enable FedRAMP mode on each computer, and confirm that your users only work with certified features.

These settings live on the computer itself. The Box service does not store them, and you cannot configure them from Box account settings or the Box Admin Console.

## Operating system requirements

### FIPS-validated cryptography

Choose a version of Microsoft Windows or Apple macOS that provides FIPS 140-2 or FIPS 140-3 validated cryptography, then configure and use it according to the vendor's security policy document. Both vendors publish their validations:

* [Windows FIPS 140 validation](https://learn.microsoft.com/en-us/windows/security/security-foundations/certification/fips-140-validation)
* [macOS security certifications](https://support.apple.com/guide/certifications/macos-security-certifications-apc35eb3dc4fa/web)

### Cipher negotiation

Make sure the cryptographic modules that the operating system provides negotiate only FIPS-validated ciphers. Windows gives you explicit controls for this. macOS does not.

On macOS, Apple requests AES-GCM cipher negotiation at a higher priority than ciphers that are not FIPS-approved. Box Tools depends on that ordering, so confirm that every version of macOS you deploy behaves this way. Until Apple provides explicit controls, validate the behavior with a network capture each time you update the operating system.

### Encryption at rest

To meet encryption-at-rest requirements, enable full-disk encryption, such as BitLocker on Windows or FileVault on macOS. Box Tools relies on the operating system for this protection, because it does not encrypt content on the computer itself.

### Web browser

Box Tools receives file authorization and metadata from Box through the web browser, so every browser your users open Box in must meet your own compliance requirements.

## Box Tools version and updates

Install the most recent version of Box Tools. FedRAMP mode requires Box Tools 4.25 or later, but treat 4.25 as the minimum rather than the version to deploy, because later releases include newer security patches.

Accept and install updates when Box Tools prompts you. Updates carry the security patches that keep Box Tools compliant.

## Enabling FedRAMP mode

<Warning>
  Box Tools does not enter FedRAMP mode until you restart the computer. Until then, Box Tools keeps working normally but does not meet FedRAMP requirements.
</Warning>

<Tabs>
  <Tab title="Windows">
    A registry value controls FedRAMP mode. Set it per machine so that it covers everyone who uses the computer, or per user if you need to enable the mode selectively. Per machine is the recommended scope.

    1. In Registry Editor, go to the key that matches your scope and version:
       * Per machine, Box Tools 4.30 or later (recommended): `HKEY_LOCAL_MACHINE\SOFTWARE\Box\Box Tools`
       * Per machine, Box Tools 4.25 to 4.29: `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Box\Box Tools`
       * Per user, any version: `HKEY_CURRENT_USER\Software\Box\Box Tools`
    2. Add a `DWORD` value named `FedRampMode` and set it to `1`.
    3. Restart the computer.

    To turn off FedRAMP mode, delete the `FedRampMode` value and restart the computer.
  </Tab>

  <Tab title="macOS">
    A preference key controls FedRAMP mode, and it applies only to the user who sets it. Set the key for every user of the computer.

    <Note>
      The macOS key name starts with a lowercase letter, `fedRampMode`, and the value is `Yes`. Both differ from the Windows equivalents, and macOS treats preference key names as case-sensitive.
    </Note>

    1. Open Terminal.

    2. Run the following command:

       ```auto theme={null}
       defaults write com.Box.Box-Edit fedRampMode Yes
       ```

    3. Restart the computer.

    To turn off FedRAMP mode, delete the preference key and restart the computer:

    ```auto theme={null}
    defaults delete com.Box.Box-Edit fedRampMode
    ```
  </Tab>
</Tabs>

## Features not certified for FedRAMP

Not every Box Tools feature is certified for FedRAMP. Before you deploy, check with your Box account team that every feature you plan to use is certified for the class you need.

Currently, Apple iWork collaborative editing is not certified at any FedRAMP class.

To keep users from reaching this feature by accident, disable the corresponding integration in the Box Admin Console. For more information, see [application settings for your enterprise](/en/box-admin-tools/how-to-guides-for-admins/application-settings-for-your-enterprise).