Sensitive data CSOs connect to DoD customers through a Cloud Access Point that protects the DISN: an off-premises commercial Level 4 or 5 CSO connects to NIPRNet only through a DISA-operated Boundary CAP (a hyper-redundant, dual-homed system with meet-me points and cyber defence sensors feeding DoDIN boundary defence) via private, redundant connections the CSP offers as a condition of the PA, with no direct traffic between the CSO and NIPRNet otherwise; an on-premises or DoD-hosted CSO connects through an Internal CAP; Level 6 connections follow SIPRNet connection approval, with mission partner environment access approved by the DoD CIO; mission systems in IaaS or PaaS still protect their own enclave boundaries and DMZ, and SaaS CSOs provide their own boundary and DMZ protections. Public-facing Level 2 and Internet-facing services use the DISN Internet access points.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.