Mission systems at every impact level must be able to encrypt DoD data at rest with DoD holding exclusive control of the encryption keys and key management, through a CSO hardware security module, a customer-dedicated HSM service, DISN-hosted DoD encryption hardware or software, or a cloud encryption service under DoD key control; this protects integrity of public information at Level 2 and confidentiality at higher levels, and enables cryptographic erase for spills and off-boarding. Mission owners perform a risk analysis with the data owners before moving data into a CSO, recognising that without encryption no high-assurance way to confirm deletion may exist.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.