CSP-CSO Readiness Checklist

This checklist is intended to help a cloud service provider (CSP) make a quick self- assessment of readiness to undergo formal Department of Defense (DoD) assessment of a cloud service offering (CSO) for DoD information impact levels above 2. CSPs should refer to the DoD Cloud Computing Security Requirements Guide (SRG) for detailed requirements. This checklist extracts and simplifies some key requirements from the Cloud Computing SRG. Throughout, the checklist refers to specific paragraphs (e.g., section 5.10.1) from the Cloud Computing SRG to make it easier for the CSP to review the full statement of requirements.

The Cloud Computing SRG defines four information impact levels based on the type of data being hosted in the cloud and outlines security objective considerations in the areas of confidentiality, integrity, and availability. Figure 1 summarizes the key security requirements for each impact level.

The checklist is structured to help a CSP identify which impact level a particular CSO might support. The checklist focuses on levels 4 and 5. The CSP should review the Cloud Computing SRG directly for assessing readiness to support level 6.

Figure 1 Key Security Requirements

A CSP may use Table 1 to quickly assess which impact level its CSO is ready to support. The CSO must be able to meet all minimum requirements listed in the table for a given impact level. The CSP should refer to the referenced section of the SRG for additional details. To streamline the DoD assessment process, the CSP should complete the “CSO Self-Assessment and Comments” column, save the file with a name that indicates the CSP-CSO, and submit this completed checklist with their DoD CSO Assessment Request form.

CSP Name Click here to enter text. CSO Name Click here to enter text.

POC Name Click here to enter text. POC Email Click here to enter text.

POC Phone Click here to enter text.

Table 1 High-Level Impact Level Checklist

ID	Item	Min Required for Level 4	Min Required for Level 5	CSO Self-Assessment and Comments
Has the CSO been government-assessed as FedRAMP v2 Moderate compliant? (sections 2.4 and 4.1)	Yes JAB PA or 3PAO- assessed Agency ATO	Yes JAB PA or 3PAO- assessed Agency ATO	Y ☐ N ☐ Select one: JAB PA ☐ 3PAO-assessed Agency ATO☐ If Agency, identify Click here to enter text. Comments: Click here to enter text.
Does the CSP agree to undergo DoD FedRAMP+ assessment to assure the CSO meets DoD’s requirements? (section 2.5)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
CNSSI 1253 categorization of CSO? (section 3.1)	M/M/x	M/M/x	Select Confidentiality level: Moderate ☐ High ☐ Select Integrity level: Moderate ☐ High ☐
Which CUI categories (see section 3.2.4) does the CSO plan to support? Does this include NSS? (e.g., export control, privacy, PII, PHI, FOUO, OUO, Law Enforcement Sensitive, Critical Infrastructure Information, Sensitive Security Information, etc.)	CUI	Higher-level CUI plus National Security Systems	Select all CUI categories supported: Export control Y ☐ N ☐ Privacy Y ☐ N ☐ PII Y ☐ N ☐ Means of ID Y ☐ N ☐ PHI Y ☐ N ☐ FOUO Y ☐ N ☐ OUO Y ☐ N ☐ Law Enforcement Sensitive Y ☐ N ☐ Critical Infrastructure Info Y ☐ N ☐ Sensitive Security Info Y ☐ N ☐ Other Y ☐ N ☐ Specify: Click here to enter text. Comments: Click here to enter text.
Does the CSO plan to support information subject to privacy protection (section 5.1.2)?	Yes or No (requirement depends on mission)	Yes or No (requirement depends on mission)	Y ☐ N ☐ Comments: Click here to enter text.
Does all customer data remain under US jurisdiction while stored or processed? (section 5.2.1)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Will there be only DoD and Federal Government tenants (customers) on the CSO and underlying infrastructure? (section 5.2.2).	Infrastructure shared with non-DoD/non-Federal Government tenants okay.	Dedicated physically-separated infrastructure from non-Federal government or non-DoD required. DoD private, DoD community or Federal Government community clouds okay.	Select one: DoD private/community ☐ Federal Gov’t community ☐ Shared infrastructure (Public; not DoD or Federal government only) ☐ Comments: Click here to enter text.
Is there strong virtual separation among the tenants / missions for both data storage and processing, having the ability to meet search and seizure requests for non-DoD information and data without release of DoD information and data? (section 5.2.2)	Yes	Yes	Y ☐ N ☐ Describe: Click here to enter text.
If the CSO is responsible for authentication of entities and/or identifying a hosted DoD information system, can the CSO integrate with the DoD PKI in accordance with DoDI 8520.03? (section 5.4)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Do the data processing facilities meet the requirements defined in the FedRAMP Moderate baseline and FedRAMP+ C/CEs related to physical security (section 5.6.1)?	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Does the CSP establish personnel position sensitivity risk determinations based on OPM guidance and the Position Sensitivity Tool? (section 5.6.2.1)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Can DOD data at rest be encrypted with validated FIPS-140-2 validated cryptography? (section 5.8)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Does only the customer have full control of generation, management, use, and destruction of the crypto keys? (section 5.10)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Can the CSO force all DoD traffic to and from the CSP infrastructure through a DoD cloud access point (CAP)? (section 5.10.1)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
For off-premises infrastructure, does the architecture include connecting via one or more boundary CAPs (BCAPs) (section 5.10.1)	Yes	Yes	Y ☐ N ☐ What CAP? Click here to enter text. Comments: Click here to enter text.
For SaaS offerings, does the CSO implement the defense-in-depth measures of section 5.10.3.1?	No	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Does the CSP have an incident response plan (or addendum) meeting the DoD additional requirements in section 6.4.1 and 6.4.2 of the SRG?	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Is the CSP willing to report all incidents via the on-line Defense Industrial Base (DIB) Cyber Incident Collection Form? (section 6.4.3)	Yes. Use of on-line form preferred.	Yes. Use of on-line form preferred.	Report via on-line DIB Cyber Incident Collection Form? Y ☐ N ☐
Do appropriate personnel have or are willing to secure either a DoD PKI certificate or DoD-approved medium assurance External Certificate Authority (ECA) certificate for secure communications with DoD entities regarding C2 or CND functions? (section 6.4.3, 6.8)	Yes	Yes	Y ☐ N ☐ Describe: Click here to enter text. Comments: Click here to enter text.
Is the CSP willing to receive, act upon, and report compliance with CND Tier II directives and notifications? (section 6.5)	Yes	Yes	Y ☐ N ☐ Comments: Click here to enter text.
Is the CSP already a member of the DIB Cyber Security / Information Assurance Program or willing to become one? (section 6.9)	No, but encouraged.	No, but encouraged.	Member? Y ☐ N ☐ Willing to become member? Y ☐ N ☐ Comments: Click here to enter text.

DISA. Department of Defense (DoD) Cloud Computing Security Requirements Guide (SRG), Version 1, Release 1. 12 January 2015. Available at http://iase.disa.mil.