DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.10.5-6: Mission owner duties using SaaS and IaaS or PaaS: defence in depth, STIGs, CSSP alignment, encryption at rest with DoD keys, one-way AD trusts

What does 5.10.5-6 require?

Mission owners contracting for SaaS address defence in depth and the security of their configuration and data at every level (even Level 2), align with a cybersecurity service provider for monitoring and defence, use DoD-approved credentials and at Level 6 the CNSS SIPRNet token. Mission owners building on IaaS or PaaS implement tiered application architecture with their own boundary protections and firewalls that they or their CSSP control and monitor, secure every component with DoD STIGs and SRGs, use FIPS 140-2 validated cryptography in FIPS mode, implement encryption at rest so that the mission owner (not the CSP) controls the keys, maintain STIGed and patched VM images or validate CSP-supplied ones, and where Active Directory integration is needed implement one-way trusts from the CSO forest to the DoD forest (or DoD-approved alternatives such as ADFS or DirSync).