Effective February 1, 2017, the Defense Information Systems Agency (DISA) issued a one-year Provisional Authorization (DoD PA) at Information Impact Level 4 for the Salesforce Government Cloud. This authorization was based on DISA's review of the Salesforce Government Cloud controls, processes, and associated documentation as required by the Department of Defense Cloud Computing Security Requirements Guide Version 1 Release 2.

The Salesforce Government Cloud FedRAMP Moderate Agency ATO, used as the basis for the DISA Information Impact Level 4 Provisional Authorization, notes that Salesforce's current policy provides that personnel supporting the Salesforce Government Cloud have completed a pre-hire commercial background investigation that verifies employment, criminal, and education history for a period spanning seven years in accordance with the policy attached hereto.

In addition to the commercial background check, many but not all Salesforce employees supporting the Salesforce Government Cloud have completed a government sponsored background check (e.g., a Moderate Risk Background Investigation or MBI). As of the date of this letter, there remain Salesforce employees supporting the Government Cloud that have not completed a government sponsored background investigation as well as employees that completed a government sponsored background investigation that needs to be renewed. To ensure that the Salesforce Government Cloud has sufficient operational and technical support capacity, Salesforce permits Salesforce employees who have not completed government-sponsored background investigations access to the Salesforce Government Cloud.

Should the DPAA or other U.S. federal government agencies require that all Salesforce Government Cloud personnel hold an MBI, the government agency must sponsor the necessary number of background investigations for the Salesforce personnel that do not have a current MBI.