Cloud Computing Mission Owner Security Requirements Guide

Version: 1

Updated: 08 Sep 2023

Findings: 25

Findings

SRG-NET-000205-CLD-000085 - The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must implement a security stack that restricts traffic flow inbound and outbound between the IaaS and the BCAP or ICAP connection. (high)
SRG-NET-000205-CLD-000090 - The Mission Owner's internet-facing applications must be configured to traverse the Cloud Access Point (CAP) and Virtual Datacenter Security Stack (VDSS) prior to communicating with the internet. (high)
SRG-NET-000205-CLD-000095 - The Mission Owner of the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must configure scanning using an Assured Compliance Assessment Solution (ACAS) server or solution that meets DOD scanning and reporting requirements. (medium)
SRG-NET-000205-CLD-000100 - The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must be configured to maintain separation of all management and data traffic. (medium)
SRG-NET-000370-CLD-000050 - The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS)/Software as a Service (SaaS) must register the service/application with the DOD DMZ/IAP allowlist for internet-facing inbound and outbound traffic. (medium)
SRG-NET-000370-CLD-000055 - The Mission Owner of the Infrastructure as a Service (IaaS) or Platform as a Service (PaaS) must remove all upgraded or replaced software and firmware components that are no longer required for operation. (medium)
SRG-NET-000383-CLD-000105 - For Infrastructure as a Service (IaaS)/Platform as a Service (PaaS), the Mission Owner must configure an intrusion detection and prevention system (IDPS) to protect DOD virtual machines, services, and applications. (high)
SRG-NET-000390-CLD-000110 - The Mission Owner of the Infrastructure as a Service (IaaS) or Platform as a Service (PaaS) must continuously monitor and protect inbound communications from external systems, other IaaS within the same cloud service environment, or collocated mission applications for unusual or unauthorized activities or conditions. (medium)
SRG-NET-000391-CLD-000115 - The Mission Owner of the Infrastructure as a Service (IaaS) must continuously monitor outbound communications to other systems and enclaves for unusual or unauthorized activities or conditions. (medium)
SRG-NET-000580-CLD-000070 - The Mission Owner of the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must implement an encrypted, FIPS 140-2/3 compliant path between the implemented systems/applications and the DOD Online Certificate Status Protocol (OCSP) responders. (medium)
SRG-OS-000001-CLD-000010 - The Mission Owner must configure the customer portal credentials for least privilege. (high)
SRG-OS-000023-CLD-000015 - The Mission Owner must configure the cloud service offering (CSO)-provided customer logon banner to display the Standard Mandatory DOD Notice and Consent Banner before granting access to users that must log on. (medium)
SRG-OS-000096-CLD-000060 - The Mission Owner must configure the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) to prohibit or restrict the use of functions, ports, protocols, and/or services. (medium)
SRG-OS-000104-CLD-000065 - The cloud service offering (CSO) must be configured to use DOD public key infrastructure (PKI) to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). (medium)
SRG-OS-000342-CLD-000020 - The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must perform centralized logging to capture and store log records. (medium)
SRG-OS-000368-CLD-000040 - For Infrastructure as a Service (IaaS) and Platform as a Service (PaaS), the Mission Owner must register through the DISA Systems/Network Approval Process (SNAP). (medium)
SRG-OS-000368-CLD-000045 - The Mission Owner of the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must remove orphaned or unused virtual machine (VM) instances. (medium)
SRG-OS-000404-CLD-000080 - For storage service offerings, the Mission Owner must configure or ensure the cloud instance uses encryption to protect all DOD files housed in the cloud instance. (high)
SRG-OS-000480-CLD-000025 - The Mission owner must obtain Authorizing Official (AO) authorization for each cloud service offering (CSO) implemented in support of production or development environments prior to operational use. (medium)
SRG-OS-000480-CLD-000030 - The Mission Owner must select and configure an Impact Level 2 FedRAMP authorized cloud service offering (CSO) when hosting Unclassified, publicly releasable DOD information. (medium)
SRG-OS-000480-CLD-000031 - The Mission Owner must select and configure an Impact Level 4/5 cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog when hosting Controlled Unclassified Information (CUI). (high)
SRG-OS-000480-CLD-000032 - The Mission Owner must select and configure an Impact Level 5 cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog when hosting Unclassified National Security Information (U-NSI). (high)
SRG-OS-000480-CLD-000033 - The Mission Owners must select and configure a cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog at Level 6 when hosting Classified DOD information. (high)
SRG-OS-000480-CLD-000035 - The Mission Owner must add all applicable compensating controls and requirements in the Service Level Agreement (SLA)/contract with the cloud service provider (CSP) or third-party provider. (medium)
SRG-OS-000580-CLD-000075 - The Mission Owner of the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must use valid DOD Online Certificate Status Protocol (OCSP) responders. (medium)