DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.10.2: Network planes: separate management and user or data planes, encrypted management traffic, VPNs and audited management transactions

What does 5.10.2 require?

CSP and mission owner network connectivity is designed on separate management and user or data planes: CSP management portals and management traffic are encrypted with FIPS 140-2 validated cryptography, management of DoD-dedicated infrastructure is restricted to a defined set of management terminals or networks (on-premises CSP management traverses a VPN, off-premises management via the DISN Internet access points or the BCAP), monitoring traffic traverses a VPN, all management transactions are audited, and virtual network devices in a mission owner's network are protected from direct access from the CSP's management plane; the same measures protect virtualised environments.