# DoD Evaluates FedRAMP 20x CUI Use

ElevenLabs’ FedRAMP Marketplace Class A (Pilot) listing covers its zero-retention mode, but the listing does not establish authorization to process Controlled Unclassified Information (CUI). The discussion distinguishes the FedRAMP 20x/Class A pathway from FedRAMP Rev. 5 Moderate authorization and reports that DISA’s current Cloud Computing SRG does not recognize 20x certifications for DoD use. For procurement teams, the key issue is whether the specific service and configuration fall within an authorization boundary acceptable for the intended data and agency use.

- Before approving a cloud service for CUI, verify its exact authorized service boundary and obtain evidence of C3PAO-assessed Moderate equivalency where applicable.
- A marketplace listing, vendor timeline, or another customer’s use alone does not establish suitability for a procurement or CUI workload.
- Cloud providers may offer services outside their authorized boundaries; acquisition and security reviews should confirm that the specific product mode and features are covered.

**Jurisdictions:** federal
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 26, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Defense Information Systems Agency (DISA)
- Federal Risk and Authorization Management Program (FedRAMP)

### Vendors
- ElevenLabs (service provider)
- Amazon Web Services (AWS) ()
- Microsoft Azure ()

### Key Quotes
> FedRAMP Ready did not mean the CSP has implemented all the required controls necessary to satisfy the federal agency or PMO.
> — Commenter (FedRAMP reviewer)

> When they updated the DISA SRG after 20x rolled out, they made it clear that they do not recognize 20x certifications for DoD use.
> — Commenter

### Sources
- [so elevenlabs is fedramp now but not for cui?](https://www.reddit.com/r/CMMC/comments/1xfxv2y/so_elevenlabs_is_fedramp_now_but_not_for_cui) - reddit-cmmc