Whatever the service type of the CSO, mission owners comply with DoDI 8551.01 on ports, protocols and services: they register their cloud-based systems and applications in the DoD PPSM registry, use only PPS with a vulnerability assessment for DISN use, and place firewalls and sensors at their enclave boundary; CSPs comply with the related FedRAMP+ controls (CM-7, SA-9) for their own networks. Mission systems do not download or execute mobile code except as DoDI 8552.01 permits, and do not enable the download of unapproved or risky mobile code. All mission owners register every cloud-based system and application, its CSP and CSO, its cyber defence provider and how it connects, in DISA's SNAP (Systems/Network Approval Process), obtain connection approval, and register public-facing URLs and IP addresses in the DoD DMZ whitelist, with the DoD Component reporting cloud computing in the budget spending summary.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.