Exchange sensitive files securely
with Kiteworks and ISEC7
Why secure file exchange is about more than email
Sensitive files rarely leave an organization through a single channel. Email attachments, a file sharing service, managed file transfer, and a department's own SFTP server often run side by side, each with its own login and its own log. The email may be encrypted, but the 200 MB attachment still travels a different route. Kiteworks brings these channels onto one platform so the same policies and the same audit trail apply to all of them.
One platform for every channel
Email, file sharing, managed file transfer, SFTP, web forms, and REST APIs all run through the same platform. Existing repositories such as SharePoint, Google Drive, or Dropbox can be connected through Kiteworks.
Policies that travel with the data
Attribute-based policies apply on top of user permissions. With Safe Edit, external users work on a file without it ever leaving the platform, with watermarking and versioning.
One log as evidence
Access and transfers are recorded in immutable audit logs and surfaced in the CISO dashboard. That is how you answer who sent which file to whom, and when.
Capabilities as listed by Kiteworks.
What Kiteworks delivers and what ISEC7 takes on
Kiteworks provides the platform; ISEC7 puts it into operation in your environment. As a Kiteworks partner, we are your point of contact for procurement, rollout, support, and ongoing operation if you want it. At ISEC7, Kiteworks extends secure communications beyond mail and voice to file exchange.
The platform: Kiteworks
As listed by the vendor
- Private Data Network for email, file sharing, managed file transfer, SFTP, web forms, and APIs
- Hardened virtual appliance with hardened Linux, firewall, WAF, and IDS, single tenant
- Customer-held encryption keys; on-premises, private cloud, or hosted, including air-gapped deployments
- TLS 1.3 in transit, AES-256 at rest
- Email Protection Gateway with S/MIME, OpenPGP, and TLS
Rollout and operation: ISEC7
Services from ISEC7
- Software procurement
- Integration and configuration in your environment
- Our own support service
- Extensions and customization through scripting
- Operation and ongoing development as a managed service
- Data classification up front with ISEC7 CLASSIFY
CMMC 2.0: what still applies to suppliers in the US defense supply chain
If you work on US defense contracts, you have to protect Controlled Unclassified Information (CUI), and flowdown clauses extend that obligation to suppliers outside the US. The Department of War suspended the CMMC Phase 2 requirements on July 13, 2026. The obligation for third-party assessment by a C3PAO is on hold; the requirements of DFARS 252.204-7012 and NIST SP 800-171 continue to apply unchanged. The self-assessment and a current SPRS score remain mandatory, which for Level 2 means the 110 controls of NIST SP 800-171 Rev. 2 (DoD CIO, CMMC program page, 2026).
For file exchange, this means every channel that carries CUI is in scope. Consolidating those channels on one platform with a shared log leaves fewer systems you have to evidence one by one.
Through our partner Kiteworks, you can operate in a FedRAMP-authorized cloud. According to the vendor, Kiteworks has held FedRAMP Moderate authorization continuously since June 2017 and has been listed as FedRAMP High Ready since March 2025; that is not an authorization at the High level. Hosting does not replace a CMMC assessment, because the assessment covers your organization. No software vendor can be CMMC certified.
ISEC7 is not a C3PAO and not an assessment body. We work through the requirements with you, define the scope, and support your operations through audit readiness. The assessment itself rests with an accredited assessor.
For the full picture, see our CMMC 2.0 page. On November 11, 2026, ISEC7 and Kiteworks will show in a webcast (in German) how to bring these channels under common control.
How secure file exchange relates to NIS2
Article 21(2) of the NIS2 Directive requires measures covering, among other things, supply chain security (point d), cryptography and encryption (point h), and secured communications (point j) (Directive (EU) 2022/2555, 2022). If you exchange data with suppliers and service providers, you need to be able to control that exchange and prove it. A platform like Kiteworks supplies technical building blocks for this: encryption, access rules, and an audit log. Compliance is achieved by your organization, not by the software. More on our NIS2 Directive page.
Before you protect data, you need to know which data is worth protecting. ISEC7 CLASSIFY classifies and labels documents and works with Kiteworks. Knowing which documents contain CUI, for example, determines what falls into scope.
Frequently asked questions about Kiteworks and secure file exchange
What is a Private Data Network?
Private Data Network is Kiteworks' term for a platform that brings email, file sharing, managed file transfer, web forms, SFTP, and APIs under shared policies and a single audit log. It was previously called Private Content Network. Access rules and evidence then apply the same way across every channel instead of being maintained system by system.
How do I share large or confidential files securely with external partners?
Instead of attaching the file, you share it through a platform that controls access, expiry, and logging. According to the vendor, Kiteworks lets you set an expiry date and a download notification per message, and external users sign in with a second factor. With Safe Edit, the file stays on the platform and the recipient works on it there, with watermarking and versioning.
How can I prove who sent which file to whom, and when?
With a central, immutable audit log that covers every exchange channel. According to the vendor, Kiteworks records access and transfers, analyzes them in the CISO dashboard and activity reports, and exports them as CSV. For an audit, you no longer have to pull together logs from several systems.
Does CMMC still apply to suppliers after the suspension of July 13, 2026?
Yes, the requirements remain. The Department of War suspended the CMMC Phase 2 requirements on July 13, 2026. The obligation for third-party assessment by a C3PAO is on hold; the requirements of DFARS 252.204-7012 and NIST SP 800-171 continue to apply unchanged. Through flowdown clauses this also affects suppliers outside the US, and the self-assessment and SPRS score remain mandatory.
Can ISEC7 certify us for CMMC?
No. ISEC7 is not a C3PAO and not an assessment body. We work through the requirements with you, define the scope, and support your operations through audit readiness. The assessment itself rests with an accredited assessor. No software vendor can be CMMC certified either; the assessment always covers the organization.
Is Kiteworks FedRAMP authorized, and is that enough for CMMC?
According to the vendor, Kiteworks has held FedRAMP Moderate authorization continuously since June 2017. For FedRAMP High, Kiteworks has been listed as Ready since March 2025, which is not an authorization at the High level. FedRAMP alone is not enough for CMMC: hosting in a FedRAMP-authorized cloud does not replace an assessment of your organization.
Can Kiteworks run on-premises or without an internet connection?
Yes. According to the vendor, Kiteworks ships as a hardened virtual appliance in a single-tenant setup and runs on-premises, in a private cloud, or hosted, including deployments without network connectivity. The encryption keys stay with the customer. We help you work out which model fits your requirements.
Does secure file exchange help with NIS2 supply chain obligations?
It covers part of them. Article 21(2) of NIS2 requires measures for supply chain security, encryption, and secured communications. An exchange platform provides encryption, access rules, and an audit log; compliance itself is achieved by your organization, not by the software. It makes sense to classify first which data needs protection, for example with ISEC7 CLASSIFY.
Information as of October 8, 2026 · Kiteworks details as listed by the vendor · CMMC status per DoD CIO, CMMC program page
Let's talk about how you exchange data
In a first conversation, we look at which channels in your organization carry sensitive data and how Kiteworks fits your environment. Send us a message using the form and we will get back to you with a proposed date.