Commercial Solutions for Classified (CSfC), explained

Commercial Solutions for Classified (CSfC) is a National Security Agency (NSA) program that lets commercial products protect classified data in national security systems (NSS) when they are configured in layers. The program's overview says it rests on one principle: properly configured, layered solutions can give adequate protection to classified data. The stated aim is a solution that can be fielded in months, not years. NSA publishes solution designs called capability packages, and products are evaluated against Protection Profiles developed through the National Information Assurance Partnership (NIAP). The CSfC frequently asked questions (FAQ) say policy of the National Security Agency/Central Security Service (NSA/CSS) mandates CSfC as the first option to be considered for a cybersecurity requirement.

Two layers of commercial encryption

The core idea is two layers of encryption from independent products. NSA's Multi-Site Connectivity Capability Package, version 1.3.0 of March 27, 2026, shows how this works between sites. Each packet or frame of classified data is encrypted twice before it crosses an untrusted network, first by an inner encryption component and then by an outer one. Either layer can be Internet Protocol Security (IPsec) from a virtual private network gateway or Media Access Control Security (MACsec).

The package names the networks by how many times the data is encrypted. A Red network holds unencrypted classified data, a Gray network holds data encrypted once, and a Black network holds data encrypted twice. Each layer has its own management network.

The layers must be independent. The inner and outer components must come from different manufacturers, neither a subsidiary of the other, or be different products that NSA has found meet its independence criteria. They must not run the same operating system, and a different service pack or version number does not count. Their cryptographic libraries must also differ. The FAQ gives the reason: diversity reduces the chance that a single vulnerability exposes the data.

Capability packages and annexes

A capability package is a vendor-neutral, solution-level design. The Capability Packages page, as captured October 1, 2026, lists five approved by the Deputy National Manager for NSS:

• Mobile Access 2.8.0 (March 27, 2026), for devices reaching a classified network across untrusted networks. The FAQ says it uses IPsec outside and IPsec or Transport Layer Security (TLS) inside.
• Campus Wireless Local Area Network (WLAN) 3.2.0 (March 27, 2026), for classified Wi-Fi within controlled spaces.
• Multi-Site Connectivity 1.3.0 (March 27, 2026), linking networks at the same security level.
• Data at Rest 5.1.0 (March 2026), with two layers protecting stored data while a device is off or not yet authenticated. The Customer Handbook says this covers data up to top secret.
• Tactical 1.0.0 (July 1, 2024), for portable network gear at the tactical edge.

Annexes add cross-cutting rules for key management, symmetric pre-shared keys, wireless intrusion detection, continuous monitoring, and running several packages together. Several 2026 updates add Commercial National Security Algorithm (CNSA) Suite 2.0 objective requirements, which the Mobile Access entry ties to post-quantum resistant algorithms. Each package has a classified risk assessment that NSA distributes on its classified websites or on request.

The components list

Customers build a solution from the CSfC Components List. A product is not added until its NIAP Common Criteria evaluation is complete and it appears on NIAP's Product Compliant List. Some selections that NIAP does not require are mandatory for CSfC listing.

The vendor signs a memorandum of agreement with NSA. The product must be NIAP certified, and the vendor agrees to fix vulnerabilities in a timely fashion. NSA weighs the vendor's past willingness to fix vulnerabilities, supply chain, and foreign ownership, control, or influence. Open source components can be listed if they have a responsible sponsor and an NSA-approved evaluation plan. NSA also permits one manufacturer to supply both layers, if the two products have significantly different code bases and the vendor documents the independence.

The multi-site package warns that modifying a NIAP-validated component may invalidate its certification.

When CSfC applies and who carries the risk

The FAQ cites two Committee on National Security Systems (CNSS) policies. CNSS Policy 7, dated December 9, 2015, covers agencies that use or plan to use CSfC solutions to protect NSS. CNSS Policy 11, dated June 1, 2013, sets a preference for layered commercial products. The program is generally for U.S. Government use, and NSA registers only government-owned solutions.

Every CSfC solution on or protecting NSS must be registered. The multi-site package requires registration and NSA approval before operation, a compliance audit every year, and a report if either layer fails to protect the data. Draft ".8" versions of a package cannot be used for registration. Trusted integrators are encouraged but optional, and they do not approve solutions.

Risk is shared. The Deputy National Manager assumes the inherent risk in the published designs. The customer's authorizing official (AO) is responsible for the fielded solution complying with the package and staying compliant, and receives NSA's risk assessment before approving use. CSfC is an alternative to government-off-the-shelf (GOTS) solutions, not a replacement.

What to check

• Which capability package and approved version does the solution follow, and is it registered with NSA?
• Are the inner and outer components from different manufacturers, or covered by an NSA independence approval?
• Do the two layers use different operating systems and different cryptographic libraries?
• Is every component on the CSfC Components List, and has any been modified since its NIAP evaluation?
• Has the AO received the NSA risk assessment, and when was the last annual compliance audit?
• Does the design plan for the CNSA 2.0 objective requirements in the 2026 packages?

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Sources

1. 1Commercial Solutions for Classified Program: Overview · National Security Agency (read from the October 8, 2026 Internet Archive capture)
2. 2Capability Packages · National Security Agency (read from the October 1, 2026 Internet Archive capture)
3. 3Components List · National Security Agency (read from the October 1, 2026 Internet Archive capture)
4. 4CSfC Frequently Asked Questions (FAQs) · National Security Agency (read from the October 17, 2026 Internet Archive capture)
5. 5Customer Handbook · National Security Agency (read from the October 1, 2026 Internet Archive capture)
6. 6Commercial Solutions for Classified (CSfC) Multi-Site Connectivity (MSC) Capability Package 1.3.0 · National Security Agency, March 27, 2026 (read from the August 28, 2026 Internet Archive capture)

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.