FedRAMP Moderate is insufficient for ITAR work, that's true. The problem is that in order to get the appropriate rating, one of the things you have to do is go

FedRAMP Moderate is insufficient for ITAR work, that's true. The problem is that in order to get the appropriate rating, one of the things you have to do is go through the FedRAMP process, and only Slack, Zoom, and MS Teams are even trying. Mattermost is self-hostable, so as long as you tightly control access, a lot of the SaaS prohibitions don't apply.