DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.1: Apply the FedRAMP baseline plus the DoD FedRAMP+ controls and parameter values for the impact level

What does 5.1 require?

A CSP seeking a DoD PA implements the FedRAMP Moderate baseline (High considered at some levels) for all impact levels and, for Levels 4, 5 and 6, the FedRAMP+ controls and enhancements DoD adds for the level (NIST SP 800-53 controls outside the FedRAMP baseline, chosen for the advanced persistent threat and insider threat, with CNSSI 1253 Moderate-Moderate categorisation), using the DoD-defined parameter values where the controls require them. National Security Systems are implemented at Level 5 or above with the NSS-specific controls; the CNSSI 1253 privacy overlay applies to CSOs holding PII or PHI at Level 4 and above, and certain controls are optionally addressed in the contract rather than the PA assessment. Level 4 and 5 PAs carry additional considerations in 5.1.7.