Extending Proofpoint Data Security and Insider Threat Management to Federal Agencies
Federal agencies are transforming how they use, share, and protect data. Cloud, AI, and collaboration platforms are creating new opportunities to advance the mission, but also new ways for sensitive information to be exposed and trusted users to create risk intentionally or unintentionally.
That’s why Proofpoint is pursuing FedRAMP High (Class D) authorization for Proofpoint Data Security and Insider Threat Management, with completion targeted for 2027.
The planned scope includes Data Security Posture Management (DSPM) and Data Access Governance, Multi-Channel Data Loss Prevention (DLP), Insider Threat Management (ITM) and Data Security for AI, building on our experience achieving FedRAMP Moderate authorization for Email Protection, Targeted Attack Protection (TAP) and Enterprise Archive solutions.
Insider Risk Is a Mandate, Not a Best Practice
For federal agencies and cleared contractors, managing insider risk isn’t optional. Executive Order 13587 created a government-wide program for deterring, detecting and mitigating insider threats. Cleared contractors operate under similar requirements through the National Industrial Security Program Operating Manual (NISPOM), with the Defense Counterintelligence and Security Agency (DCSA) assessing implementation through recurring security reviews.
The stakes extend well beyond compliance. Insiders may have legitimate access to classified information, Controlled Unclassified Information (CUI), sensitive systems, and other national security resources. Misuse of that access—malicious or unintentional—can lead to unauthorized disclosure, espionage, fraud, sabotage or degradation of critical capabilities.
To further protect CUI, the Defense Industrial Base organizations using SaaS solutions must select services that meet at least FedRAMP Moderate security requirements, in accordance with DFARS 252.204-7012. FedRAMP High goes further, applying a more stringent baseline for high-impact data. Organizations handling ITAR- or EAR-controlled data may also face additional restrictions around data residency and personnel access.
Meeting the mandate requires more than monitoring user activity. It also requires distinguishing routine work from meaningful risk and building enough evidence to act before harm is done.
Proofpoint connects signals across people, data, activity and communications to reveal not just what users are doing, but the context and motive behind it. This helps security teams uncover risks isolated events would miss, distinguish routine activity from meaningful risk, and intervene before concerning behavior results in data loss, fraud, sabotage, espionage or other harm.
AI Is Giving Sensitive Data More Ways to Leak
Federal agencies and defense contractors must also protect sensitive information—including CUI, Personally Identifiable Information (PII), acquisition and mission data—across on-premises systems, cloud services, collaboration environments, endpoints and mission partners. As AI expands how that information is accessed, shared and used, security teams need to know where it resides, who and what can access it, and whether that access is appropriate. A poor understanding of the data posture (where sensitive data is), excessive access, misconfigurations or inappropriate sharing create multiple areas of exposure.
For federal organizations, these aren't just security priorities—they're compliance requirements. The Federal Information Security Modernization Act (FISMA), NIST Special Publication 800-53 and the federal Zero Trust Strategy reinforce a data-centric approach built around identifying sensitive information, controlling access and continuously managing risk. Cybersecurity Maturity Model Certification (CMMC) similarly requires Defense Industrial Base organizations to safeguard CUI. Meeting these requirements also means demonstrating that protections remain effective as conditions change.
Proofpoint provides continuous control across the data lifecycle—helping agencies discover and classify sensitive information, identify and remediate excessive access, and prevent data loss across email, cloud, endpoints, collaboration and AI. By connecting data sensitivity with identity, access and activity, Proofpoint reveals risks that isolated controls miss and help security teams reduce exposure before sensitive information is lost or misused.
Data and Insider Risk Are Stronger Together
Data Security and Insider Threat Management become more powerful when they operate from the same understanding of risk.
Data Security provides insight into the information itself—what is sensitive, where it resides, who and what can reach it, while Insider Threat Management connects behavior, activity, context and motive to determine what represents meaningful risk and why.
That combination becomes even more important as AI assistants retrieve sensitive information on users' behalf and AI agents act across enterprise systems. As these interactions grow in volume and speed, agencies need to evaluate data, identity, access and behavior together—not in isolation. This approach also aligns with CISA's Zero Trust Maturity Model, which describes more mature security operations as correlating information across multiple sources and using context to automate orchestration and response.
Looking Ahead
Federal agencies should not have to choose between accelerating AI adoption and maintaining control of their most sensitive information. Our goal is to help them protect that information, understand and reduce the insider risk surrounding it, and securely embrace the technologies changing how government works.
Pursuing FedRAMP High is our next step toward delivering on that goal, building on our FedRAMP Moderate experience. We'll share updates as the authorization process moves forward. To learn more about our roadmap and how Proofpoint supports the security and compliance requirements of federal agencies and Defense Industrial Base (DIB) organizations, contact your Proofpoint account team.