MyWorkDrive logo


MyWorkDrive Solutions for the Public Sector

MyWorkDrive is a self-hosted secure file access platform. It installs on agency-controlled Windows Server infrastructure or deploys a Windows Server instance on a cloud platform like Microsoft Azure or AWS. MyWorkDrive gives staff browser, mapped drive, and mobile access to the storage the agency already owns. File content never passes through or rests on MyWorkDrive servers, so data stays in agency-controlled locations regardless of what any vendor contract says.

Core Solutions and Who They Serve

  • FedRAMP-supported secure file access. Deploy on Azure Government or agency-owned hardware with no new cloud service provider to authorize. A hybrid option pairs the agency-hosted server with FedRAMP-authorized Microsoft 365 for browser document editing over an outbound-only connection while files remain on agency storage.
  • FISMA reporting support. A single audit trail covers every connected repository, with Syslog export to Splunk, Microsoft Sentinel, or QRadar. Security teams work from a single log source for file activity across every connected storage platform.
  • Benefit: shorter security review cycles, because there is no third-party data processor to evaluate and existing identity and monitoring controls continue to apply.

  • CUI protection aligned with CMMC 2.0. Control family alignment for access control (AC), audit and accountability (AU), identification and authentication (IA), and system and communications protection (SC), with detailed mappings available for assessment preparation. FIPS 186-4 validated RSA cryptography (NIST Certificate #3018) and Windows FIPS mode support.
  • Fully private deployment for sensitive environments. Every component, including an on-premises Office Online Server for document editing, can run inside the network boundary with no outbound cloud connections. Suitable for air-gapped and restricted networks.
  • Benefit: contractors keep CUI on infrastructure they manage while giving remote engineers and program staff normal file access, which narrows assessment scope compared with moving data into a shared cloud.

  • VPN replacement for remote and field staff. Application-level HTTPS access to existing Windows file servers for county, municipal, and state employees. SMB and NetBIOS ports stay closed to the internet, and each session reaches only the files that user is authorized to open.
  • Consolidation without migration. Agencies running a mix of on-premises shares, SharePoint Online, and cloud storage present everything through one interface with one set of policies. A documented state agency deployment consolidated five separate file access methods into one and unified auditing across on-premises SMB and SharePoint Online.
  • Benefit: lower recurring spend on VPN licensing and support tickets, and an exit from aging remote access infrastructure without a migration project or re-permissioning effort.

  • Student and faculty file access without VPN. Browser access works on any personal device with no client install, which suits student populations.
  • Microsoft license optimization. Browser-based Office editing lets institutions assign lower-cost Microsoft license tiers to eligible users, a documented source of recurring savings alongside VPN elimination.
  • Benefit: budget relief and fewer help desk tickets for password resets and connection problems, with research data staying on institution-controlled storage.

  • One console, minimal footprint. Shares, policies, DLP rules, device approval, and audit settings are managed from a single admin console on standard Windows Server. Deployment from install to first user averages under two hours, and multi-server configurations provide high availability.
  • Existing permissions stay authoritative. NTFS ACLs, SharePoint permissions, and cloud storage access controls continue to govern authorization. MyWorkDrive can restrict further by policy but can never grant more than the underlying storage allows, and access-based enumeration hides content users cannot open.
  • Benefit: there is no second permission system to maintain, and because files stay in place, the agency can add, move, or retire storage platforms over time without re-platforming file access.

Value Propositions: Why Agencies Buy

  • Data sovereignty is structural. File content never transits or rests on vendor systems. Agencies subject to CJIS handling rules, state residency statutes, or cross-border restrictions can demonstrate compliance directly from the deployment design.

  • Stronger security posture. Replacing network-level VPN access with least-privilege, identity-verified file access reduces lateral movement risk and supports federal Zero Trust mandates. MFA and Conditional Access are enforced by the identity provider the agency already operates, and MyWorkDrive stores no credentials.

  • Measurable cost reduction. Agencies eliminate VPN licensing and infrastructure, avoid migration projects, reduce access-related help desk tickets, and can right-size Microsoft licensing.

  • Short deployment timelines. Because no data moves and no permissions change, production deployments complete in days or weeks, while storage migrations and VDI rollouts commonly run for months. A free 14-day trial runs on agency infrastructure against agency storage and identity, so security teams validate real conditions before purchase.

  • Compliance evidence is built in. Complete audit trails, SIEM export, DLP enforcement, and a documented shared responsibility model give agencies the artifacts their assessors and auditors ask for.

Key Differentiators

  • Versus cloud file sharing platforms: enterprise file sync and share products move data into a vendor-operated repository, which adds a new data processor to the agency supply chain and forces a migration project. MyWorkDrive connects to storage in place and enforces the permissions already there.

  • Versus VPN: A VPN opens a path to the whole network even when the user needs a handful of documents, and the tunnels generate ongoing licensing and support costs. MyWorkDrive delivers only the files a user is authorized to reach, over HTTPS, and logs each file action individually, which a VPN tunnel cannot do.

  • Versus global file system and caching appliances: appliance-based hybrid storage vendors replicate data into their own object store and require hardware or virtual appliances at each site. MyWorkDrive needs no appliances and never replicates data, at lower cost and with far less administration.

  • Versus virtual desktop infrastructure: VDI solves remote file access by shipping an entire desktop, with the licensing and image management burden that follows. Agencies that only need file access get it from MyWorkDrive with native File Explorer, Finder, browser, and mobile experiences and none of the VDI overhead. Documented deployments include a state agency that retired aging Citrix infrastructure.

  • Broadest storage reach in its category. One deployment publishes Windows file servers, DFS namespaces, on-premises NAS, SharePoint and SharePoint Online, OneDrive, Azure Files, Azure Blob, Azure NetApp Files, Amazon FSx, and S3-compatible object storage including AWS S3, MinIO, and Wasabi, side by side, with one sign-in and one audit trail covering all of it.

  • Validated cryptography and public sector procurement. FIPS 186-4 validated RSA (NIST Certificate #3018), Windows FIPS mode support, and availability through GSA IT Schedule 70 and NASA SEWP distinguish MyWorkDrive from remote access tools that lack federal procurement paths.

  • Storage independence by design. Files never leave agency storage, so the agency's data strategy stays fully in its own hands. Cloud migrations, storage consolidations, and platform changes proceed on the agency's timeline, and file access continues uninterrupted through them.

Platform Capabilities

  • Windows SMB file shares, DFS namespaces, and on-premises NAS with automatic NTFS permission enforcement.
  • SharePoint, SharePoint Online, and OneDrive, with tenant policies and sharing restrictions remaining in effect.
  • Azure Files, Azure Blob, and Azure NetApp Files for cloud and hybrid environments.
  • Amazon FSx and S3-compatible object storage, including AWS S3, MinIO, and Wasabi, which supports agencies running object storage on their own hardware.

  • Web browser access from any device with no client installation.
  • Mapped drive clients for Windows and macOS with native File Explorer and Finder integration, preserving the workflows staff already know.
  • Mobile apps for iOS and Android with device approval controls.
  • Browser-based Office editing through Microsoft 365 or an on-premises Office Online Server for restricted networks, plus traditional Office file locking to prevent editing conflicts.

  • Native integration with Active Directory, Microsoft Entra ID, ADFS, SAML providers, and Duo; single sign-on across web, mapped drive, and mobile clients.
  • MFA and Conditional Access enforced at the identity layer; directory de-provisioning removes access immediately; session timeouts configurable to agency policy.

  • TLS 1.2+ on all communications with TLS 1.3 preferred; FIPS 186-4 validated RSA cryptography; data at rest protected by existing Windows, Azure, or SharePoint encryption.
  • Per-share, per-group, and per-user DLP controls to disable downloads, printing, and clipboard use; secure view-only mode with dynamic watermarks carrying username and timestamp.
  • Device approval whitelisting, minimum client version enforcement, and blocking of unknown devices.
  • Inbound exposure limited to HTTPS on port 443, or zero inbound ports using the outbound-only Cloud Web Connector.
  • Password-protected external sharing links with expiration and audit trails; Microsoft Entra B2B guest integration places outside collaborators under agency access reviews.

  • Designations and framework support: FIPS 186-4 validated (NIST Certificate #3018); CMMC 2.0 control family alignment; FedRAMP-supported deployment architecture; HIPAA technical safeguards with a Business Associate Agreement available; CJIS data handling support; GDPR Article 32 alignment. Program certifications are achieved and maintained in the agency environment, with detailed control mappings available on request.
  • Centralized logging of opens, downloads, edits, share-link creation and revocation, authentication events with identity provider claims, and administrative actions, across all connected storage.
  • Syslog export to Splunk, Microsoft Sentinel, QRadar, and other SIEM platforms; built-in health dashboard with configurable threshold alerts including mass download notification.
  • Documented shared responsibility model covering identity, authorization, storage security, monitoring, and compliance evidence, simplifying ATO and audit preparation.

  • Single admin console for all shares, policies, and controls; REST APIs for management and automation; multi-server high availability; average deployment under two hours from install to first user.