DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.2.2: Separation requirements by impact level: virtual separation at Level 4, dedicated government community infrastructure at Level 5, classified facilities at Level 6

What does 5.2.2 require?

At Level 2 any deployment model is acceptable with physical location restricted. At Level 4 any deployment model is acceptable, but the CSP must show strong virtual separation controls and monitoring that allow a search or seizure demand aimed at another customer's data to be met without releasing DoD data (and vice versa) and that prevent a co-tenant on the same hardware from reaching DoD data. At Level 5 only DoD private or community clouds or federal government community clouds qualify, on infrastructure dedicated to federal government tenants with physical or logical separation from non-federal customers, and the CSP's privileged management plane for that infrastructure dedicated accordingly. At Level 6, information up to SECRET is stored and processed only in cleared facilities on infrastructure dedicated to DoD and federal classified tenants, connected via SIPRNet, under CNSS policy. Separation also supports law enforcement and criminal investigation needs.