The DISA Cloud Service Support strives to:

• Extend commercial cloud services to DOD Agencies/CCMDs/Services, while ensuring mission assurance and information interoperability is maintained
• Draft, publish, and maintain guidance documentation to include the DOD Cloud Computing Security Requirements Guide
• Evaluate evidence from Cloud Service Providers for compliance to DOD Cloud Guidelines and issue DOD Provisional Authorizations (PAs) depending on results of compliance evaluations
• Participate in collaboration and information sharing with Components and Cloud Service Providers on cyberspace defense related matters

DOD cloud consumers may seek support from the DISA Cloud Services Support office to fulfill their cloud service requirements. The DISA Cloud Services Support office uses the cloud service request form (CSR) to collect information from cloud consumers about their cloud service requirements and match the requirement with cloud provider capabilities.

If a mission need cannot be met by a cloud service offering (CSO) already in the catalog, the mission owner may request a new cloud service offering be assessed for supporting DOD missions and sponsor the DOD assessment.

Before submitting a request for a DOD assessment, the cloud service provider (CSP) should first complete the CSP-CSO Readiness Checklist. The checklist is intended to help a CSP perform a quick self- assessment of readiness to undergo formal DOD assessment of a cloud service offering for DOD information impact levels above 2. Refer to the DOD Cloud Computing Security Requirements Guide (SRG) for detailed requirements.

Next, the CSP or DOD sponsor should complete the DOD CSO Assessment Request form.

The CSP or DOD sponsor should submit the completed DOD CSO Assessment Request form and the CSP-CSO Readiness Checklist to disa.meade.re.mbx.disa-commercial-cloud@mail.mil.

The Cloud Support Services team will evaluate the submitted material. If the CSO is ready for assessment, the team will prioritize the request and schedule available resources for the assessment. These general guidelines are used to establish assessment priority.

• Top Priority: CSPs with a DOD sponsor and supporting a high priority DOD mission as recognized by a DOD chief information officer or J6 general officer. In the event multiple CSPs fall into this category, security assessment priority will align with Joint Chiefs of Staff priority order for the mission.
• CSP renewing an expiring provisional authorization and currently host DOD IT Projects
• CSP with a DOD sponsor with these prerequisites: (1) CSP has completed the FedRAMP process; (2) CSP has an existing contract; (3) CSP rate high on readiness checklist.
• CSP with DOD sponsor currently operating in a DOD private cloud scenario and has a second DOD sponsor seeking its services.
• CSP with a DOD sponsor not meeting the above conditions.

Visit the Cloud Services Portal for:

• DISA Cloud Services Support
• DOD Cloud Services Announcements 
• Authorized DOD Cloud Services Catalog
• FAQs
• Contact Us
• Lessons Learned
• Cloud Pilot Status

Policy

• DOD Instruction 8500.01, Cybersecurity
• Chairman of the Joint Chiefs of Staff Manual 6510.01B, Cyber Incident Handling Program
• Executive Order 13526, Classified National Security Information

Standards

• DOD Cloud Computing Security Requirements Guide (SRG)
• Security Technical Implementation Guide (STIG)
• Official DOD Issuances/Instructions
• Federal Risk and Authorization Management Program (FedRAMP)
• NIST Special Publications
• CNSSI 1253: Security Categorization and Controls Selection for National Security Systems
• CNSSI 4009: National Information Assurance (IA) Glossary
• NIST SP 800-37, Revision 1: Guide for Applying the Risk Management Framework to Federal Information Systems
• NIST SP 800-59: Guideline for Identifying an Information System as a National Security System
• NIST SP 800-66, Revision 1: An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule
• NIST SP 800-88, Revision 1: Guidelines for Media Sanitization
• NIST SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)
• NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing
• NIST SP 800-145: Definition of Cloud Computing
• NIST SP 800-146: Cloud Computing Synopsis & Recommendations
• NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations
• NIST SP 500-292: Cloud Computing Reference Architecture
• CIO Council & Chief Acquisition Officers Council: Creating Effective Cloud Computing Contracts for the Federal Government