A SaaS company is evaluating Box for FedRAMP Moderate data storage and movement, specifically questioning how to manage user access within or outside of their secure virtual machine environment.

{
  "signal_id": "b1f65041-58c7-5553-ab53-53c2f574478e",
  "signal_type": "reddit-company",
  "signal_subtype": "buyingIntent",
  "detected_at": "2026-09-24T20:53:09+00:00",
  "company": {
    "name": "Box",
    "domain": "box.com"
  },
  "data": {
    "nsfw": false,
    "stage": "researching",
    "awards": 0,
    "timing": "in_progress",
    "topics": [
      "fedramp",
      "cmmc",
      "compliance",
      "secure file storage",
      "vendor evaluation"
    ],
    "post_id": "1wpdawd",
    "summary": "A SaaS company is evaluating Box for FedRAMP Moderate data storage and movement, specifically questioning how to manage user access within or outside of their secure virtual machine environment.",
    "category": "Secure File Storage",
    "comments": [
      {
        "url": "https://www.reddit.com/r/CMMC/comments/1wpdawd/comment/pbv7lu4/",
        "depth": 0,
        "score": 2,
        "author": "greenturtlesteak",
        "excerpt": "I’ve worked with a handful of clients that used box federal and had successful assessments. The key technical pieces that made the assessment move along without friction on this item were:\n\n SSO setup with Entra and requiring device compliance to login.\n\n Connecting Box to Defender for Cloud Apps and ensuring all the activity logs were sent back to Defender and Sentinel.\n\n Collaborating with outsi",
        "posted_at": "2026-09-24T23:19:34.000Z",
        "author_url": "https://www.reddit.com/user/greenturtlesteak/"
      },
      {
        "url": "https://www.reddit.com/r/CMMC/comments/1wpdawd/comment/pbuhbnz/",
        "depth": 0,
        "score": 1,
        "author": "OGT242",
        "excerpt": "FedRAMP'd solutions have a CRM/SRM that lays out what the customer, you, is responsible for. When it comes to any \"collaboration\" solution, the due diligence of the Org is to control the flow of CUI. Everyone handles this differently. You need to prove that you maintain control of the data. If you are going to allow people to download data from these solutions, you need to make sure they can handl",
        "posted_at": "2026-09-24T21:07:25.000Z",
        "author_url": "https://www.reddit.com/user/OGT242/"
      },
      {
        "url": "https://www.reddit.com/r/CMMC/comments/1wpdawd/comment/pbzjyap/",
        "depth": 0,
        "score": 1,
        "author": "BRS-Global",
        "excerpt": "Box/Kiteworks/Preveil only help if you still control who gets to the files and from where.\n\n If people can log into Box from a regular laptop outside the VM and download stuff, that laptop is now in scope. Most shops lock sign-in to managed devices or to inside the approved environment. A separate VM-only account is pretty common too, and way easier to defend than one login that works everywhere.",
        "posted_at": "2026-09-25T15:15:31.000Z",
        "author_url": "https://www.reddit.com/user/BRS-Global/"
      },
      {
        "url": "https://www.reddit.com/r/CMMC/comments/1wpdawd/comment/pcihlnn/",
        "depth": 0,
        "score": 1,
        "author": "Affectionate_Text183",
        "excerpt": "Sounds like you need virtual data room software. Maintains a full audit trail with activity reporting. Only authorized or permissioned users can view the documents via the software.",
        "posted_at": "2026-09-28T04:27:48.000Z",
        "author_url": "https://www.reddit.com/user/Affectionate_Text183/"
      }
    ],
    "evidence": [
      "[title] Using web things like Box/Kiteworks/preveil outside of boundary?",
      "[post] Looking into those solutions for fedramp moderate data storage and movement.",
      "[post] Can we allow users to go to box.com outside of virtual machine or lock it down to only there"
    ],
    "virality": "medium",
    "post_date": "2026-09-24T20:53:09.000Z",
    "post_kind": "text",
    "post_text": "Looking into those solutions for fedramp moderate data storage and movement.\n\nOur SaaS company has a secure virtual machine environment that runs all fedramp approved software.\n\nSome of files coming in come on physical media or come to other teams that are not in fedramp virtual machine. We can restrict that users can only sign into box.com from virtual machine.\n\nCan we allow users to go to box.com outside of virtual machine or lock it down to only there\n\nEasier to just force users to have extra account for virtual machine like other approved fedramp folks?\n\nHow to deal with physical media that comes in that needs to go on box.com within virtual machine?\n\nNew to this and sorry! Looking for any advice",
    "sentiment": "neutral",
    "subreddit": "CMMC",
    "post_title": "Using web things like Box/Kiteworks/preveil outside of boundary?",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/CMMC/comments/1wpdawd/using_web_things_like_boxkiteworkspreveil_outside/",
    "entity_role": "vendor",
    "post_author": "sectestpen1",
    "upvote_ratio": 1,
    "mention_count": 2,
    "mention_surge": false,
    "subreddit_url": "https://www.reddit.com/r/CMMC/",
    "total_upvotes": 5,
    "comments_total": 8,
    "total_comments": 8,
    "other_companies": [
      {
        "name": "Kiteworks",
        "role": "alternative",
        "domain": "kiteworks.com"
      },
      {
        "name": "PreVeil",
        "role": "alternative",
        "domain": "preveil.com"
      }
    ],
    "post_author_url": "https://www.reddit.com/user/sectestpen1/",
    "signal_category": "intent",
    "comments_included": 4,
    "products_mentioned": [
      "Box Federal"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/b1f65041-58c7-5553-ab53-53c2f574478e \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"box.com","limit":20}'