Key Takeaways
- Revenue Cloud runs in Government Cloud Plus as an interoperable product and isn’t available in Government Cloud Plus Defense.
- Quotes and attachments can hold CUI, ITAR technical data and sensitive pricing.
- Settle your CMMC boundary and integration plan before configuration starts.
- Salesforce secures the platform. Your team owns access and configuration.
Source: https://www.salesforce.com/news/stories/revenue-cloud-news/
Why the Security Review Should Come First
We are seeing more government contractors and aerospace and defense manufacturers move their quoting off legacy Salesforce CPQ and onto Revenue Cloud. (Our post on Salesforce CPQ vs Revenue Cloud covers what changed.) The riskiest moment in these projects tends to come halfway through the build, when the security team sees the plan for the first time.
The reason is that quoting data is security data. Revenue Cloud handles quote-to-cash, the full path a deal takes from pricing and quoting through contracts and billing. In defense work, a single quote can carry part numbers tied to export-controlled designs, labor rates a competitor would love to see, and terms pulled from a government contract.
If you’ve already decided Revenue Cloud fits your business, the next step is the one most teams skip. Bring your security and compliance reviewers in early, and give them answers to the six questions below.
These are specifically for sales operations leaders at government suppliers, and the security officers and compliance leads who have to sign off on their systems. Each question explains the terms involved and what a good answer looks like.
1. Which Salesforce Environment Will Revenue Cloud Run In?
Start here, because the answer can stop a project before it begins.
Salesforce runs two separate environments for government work. Government Cloud Plus holds FedRAMP High authorization. FedRAMP is the federal program that reviews the security of cloud services, and High is its top rating for unclassified data. Government Cloud Plus Defense goes a step further with Impact Level 5 (IL5), the Department of Defense standard for its most sensitive unclassified information.
Source: https://www.salesforce.com/government/cloud/
Inside each environment, Salesforce sorts products into two groups. Authorized products sit inside the FedRAMP boundary, which means independent assessors reviewed their security. Interoperable products have been tested to work in the environment, but no assessor has reviewed them, so they sit outside that boundary.
As of Salesforce’s October 2026 availability list, Revenue Cloud Growth, Revenue Cloud Advanced and Revenue Cloud Billing are all interoperable in Government Cloud Plus. None are available in Government Cloud Plus Defense. If your org runs in the Defense environment, Revenue Cloud isn’t an option today.
In Government Cloud Plus, using an interoperable product is a risk-based decision your security team makes and owns. Salesforce also expects customers to test interoperable products in a sandbox (a non-production copy of the org) before going live. Legacy CPQ has the same interoperable status, so moving to Revenue Cloud doesn’t change your authorization picture. Your reviewers will still want that decision written down.
If you’re still weighing environments, our guide to Salesforce Government Cloud vs Commercial Cloud walks through the tradeoffs.
2. Where Does Sensitive Data Show Up in Your Quotes?
Most teams picture a quote as a price and a customer name. In defense work, it often holds much more.
Two terms come up constantly here. Controlled unclassified information (CUI) is government data that isn’t classified but still has to be protected by law or contract. ITAR, the International Traffic in Arms Regulations, controls who can see technical data tied to defense articles. That rule applies inside your own company too, so a non-U.S. employee on the sales team may not be allowed to open certain quotes.
Where controlled data hides in a quote
Select each part of this sample quote to see what can end up there.
Four places to check
In a quote-to-cash system, controlled data tends to land in four places. Start with any part of the quote.
Product catalog
The product catalog may include specs or configuration rules that reveal controlled designs.
Line items and notes
Quote line items and notes may reference contract numbers or program details.
Attachments
Attachments such as statements of work, drawings and customer RFQs are the most common home for ITAR data.
Approval comments
Approval comments are the spot people forget, because reviewers often explain their reasoning in plain text.
All four, at once
Map each of these before anyone designs a screen. You want a clear list of which fields and files can hold CUI or ITAR data.
0 of 4 reviewed
Map each of these before anyone designs a screen. You want a clear list of which fields and files can hold CUI or ITAR data. From there your team can decide what belongs in Salesforce, what stays in a separate controlled system, and what gets referenced by ID only.
The map matters even more because Revenue Cloud sits outside the FedRAMP boundary. Defense contracts include a clause, DFARS 252.204-7012, that expects any cloud service storing covered defense information (the DoD's term for CUI tied to its contracts) to meet security requirements equivalent to FedRAMP Moderate. Your reviewers will want to know exactly what controlled data could land in Revenue Cloud.
These are the same ITAR questions we worked through when we built an ITAR-compliant Salesforce Government Cloud environment for an aerospace and space propulsion manufacturer. That team needed a compliant, production-ready org on an accelerated timeline while keeping the build as standard as possible, which only works when compliance decisions come before configuration.
3. Does Your Quoting System Fall Inside Your CMMC Boundary?
The Cybersecurity Maturity Model Certification (CMMC) is how the Department of Defense checks that contractors protect CUI. Most contractors that handle CUI need Level 2, which means meeting the 110 security requirements in a federal standard called NIST SP 800-171. Today, most contractors confirm this with a self-assessment. The Department of Defense paused its plan to require third-party assessments in July 2026 while it reviews the program, but the 110 requirements still apply.
Your assessment boundary is the set of systems, people and facilities an assessment will review. Any system that stores, processes or sends CUI falls inside it. If question two showed CUI in your quotes or attachments, Revenue Cloud is in scope.
This is one of the CMMC compliance requirements for Salesforce CRM that a migration can quietly change. A CPQ tool that only held prices may have sat outside your boundary. A Revenue Cloud build that adds contracts, billing and document generation can pull it inside.
Ask your compliance lead whether the current quoting system appears in your System Security Plan, the document that describes every system in scope and how each one is protected. Then ask whether the new design changes that. If it does, budget time for the documentation work during the build, while the design details are fresh.
4. Who Can See Your Pricing, Discounts and Approvals?
Security teams ask this question less often than the others, yet it matters most for quote-to-cash.
For a government contractor, pricing is sensitive on its own. Labor rates, discount thresholds and bid pricing are exactly what a competitor wants before a recompete. Federal procurement rules also protect contractor bid and proposal information, so a leak can become a legal problem on top of a business one.
Three controls to plan before you build
| Control | Salesforce tools | What to settle early |
|---|---|---|
|
Who needs full price books, who only needs the final quote, and whether partners or resellers log in | |
|
Revenue Cloud puts all of your pricing in one place, which is a large part of its value. It also means one wrong permission setting can expose every rate you have. Salesforce lets you control access at three levels. Object-level access decides whether someone can see a type of record at all, such as price books. Record-level access decides which specific records they see, such as quotes for their own programs. Field-level access hides individual values, such as cost or margin, even on a record someone can open. Decide who needs full price books, who only needs the final quote, and whether partners or resellers will log in at all. We see this get more complex for companies that quote fixed-price, cost-plus and IDIQ work in the same system, since each contract type exposes different numbers. Mapping those differences into the access model is a core part of how we approach Salesforce for aerospace and defense quote-to-cash. |
||
|
How you'll show who approved each discount and when, in case of a DCAA audit | |
|
If you price government work, your pricing decisions may need to hold up in an audit by the Defense Contract Audit Agency (DCAA), the office that reviews contractor costs and pricing. Your reviewers will want a record of who approved each discount and when. Revenue Cloud's approval workflows capture much of that history. Salesforce Shield fills the gaps. Its Field Audit Trail keeps a longer record of changes to price fields, and Event Monitoring shows who viewed or exported sensitive records. Both are FedRAMP High authorized in Government Cloud Plus. |
||
|
Which fields need encryption, since it can limit search, reporting and some automation | |
|
Shield Platform Encryption scrambles specific fields while they're stored, so cost data or margin stays protected even at the database level. Encryption can limit search, reporting and some automation on those fields. Pick the fields that need it early in design, while changes are still cheap. |
||
5. How Will Data Move Between Revenue Cloud and Your Other Systems?
Revenue Cloud rarely works alone. Quotes feed contracts, contracts feed billing, and billing feeds an ERP, the system that runs accounting and operations. For government suppliers that is often Deltek, SAP or Oracle. Every connection between these systems is a path controlled data can travel.
For each integration, your reviewers will ask where the data goes and whether the receiving system is allowed to hold it. The integration tool counts too. According to Salesforce's availability list, MuleSoft is interoperable in Government Cloud Plus, while MuleSoft Government Cloud has its own FedRAMP Moderate authorization. MuleSoft also launched a separate Government Cloud Plus version in October 2026, so confirm its current authorization status with your Salesforce account team. Apps from the AppExchange, Salesforce's app marketplace, sit outside Salesforce's authorization boundaries entirely, though many run inside the platform and keep data there.
This is where Salesforce integration architecture best practices pay off in the security review. Point-to-point integrations, where each system connects directly to every other one, multiply the paths reviewers have to trace. A central integration layer with a documented list of the fields that cross each connection gives them one place to look. That same list doubles as evidence for your next audit, and it's a natural starting point for any Salesforce integration architecture plan.
6. What Does Your Side of Shared Responsibility Look Like After Go-Live?
Salesforce security compliance for government contractors runs on a shared responsibility model. We like to describe it this way: Salesforce provides the secure building, and your organization is responsible for the locks and alarms inside it. That means your team owns how the org is configured, who has access, and what data goes in.
Source: https://www.salesforce.com/blog/shared-responsibility-cloud/
Your half doesn't end at launch. New products get added to the catalog. Sales teams turn over. A partner portal gets switched on for a new program. Each change can widen access to pricing or controlled data.
Before go-live, name an owner for access reviews and decide how often they happen. Agree on who approves changes to price books, sharing settings and integrations. A clear owner and a steady review rhythm will do more for you than any single security tool. If your internal team is stretched, this ongoing upkeep is a good fit for Salesforce managed services.
Final Thoughts
Most contractors can find a workable answer to every one of these questions. The cheapest time to find it is while the design is still on paper.
The teams that move fastest put their security lead in the room at kickoff. They map controlled data before anyone configures a price book, and they settle the CMMC boundary question during design. When Salesforce CRM for government suppliers is built that way, the security review turns into a routine checkpoint.
For a deeper look at how compliance shapes the way defense contractors build in Salesforce, watch our webinar "Inside the Defense Digital Stack":
Ready to Plan Your Revenue Cloud Security Review?
Vectr Solutions helps government contractors and aerospace and defense manufacturers plan Revenue Cloud implementations that their security teams can approve.
Reach out to work through these questions with your team before the build starts!
