GlobalSCAPE (now part of Fortra’s data security portfolio) has long been a name in secure file transfer. But the question for compliance officers and IT security managers is clear:

By [Author Name]

| NIST 800-171 Family | GlobalSCAPE Capability | Gaps / Notes | |----------------------|------------------------|---------------| | | Granular folder/user permissions; IP allowlisting; session timeouts | Requires careful configuration—overly permissive default roles could expose CUI | | Audit & Accountability (AU) | Full user activity logging; immutable audit trails (with WORM storage) | Logs must be protected from modification; EFT supports this if configured to write to non-editable storage | | Configuration Management (CM) | Secure baseline templates; change logging | No automated compliance scanner for DISA STIGs (you must manually verify settings) | | Identification & Authentication (IA) | MFA support (TOTP, smart cards, RADIUS); password complexity enforcement | MFA is an add-on module (not base); for CUI, MFA for all interactive logins is strongly recommended | | System & Communications Protection (SC) | TLS 1.2/1.3 for data-in-transit; OpenPGP and SMIME for encryption; DMZ gateway support | No built-in data-at-rest encryption for CUI files stored on local drives (requires underlying OS/disk encryption like BitLocker) | | System & Information Integrity (SI) | Antivirus scanning via ICAP; file integrity monitoring (checksums) | No native FIM for configuration files; must integrate with third-party tools | 3. The Critical Weakness: CUI Data-at-Rest One area where organizations often misunderstand GlobalSCAPE is data-at-rest encryption .

| Feature | GlobalSCAPE EFT | GoAnywhere MFT | Titan SFTP Server | |---------------------------|------------------|----------------|---------------------| | FIPS 140-2 validation | Yes | Yes | Yes | | Built-in data-at-rest encryption | No (OS-level only) | Yes (AES-256) | Yes | | Native CMMC compliance report | No | Yes | No | | MFA included | No (add-on) | Yes | Yes (basic) | | DMZ gateway for CUI isolation | Yes | Yes | No |

GlobalSCAPE lags behind some competitors in offering native data-at-rest encryption and compliance dashboards. 6. Final Verdict: Is GlobalSCAPE "Good Enough" for CUI? Yes, but with caveats.