DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3
Section 5: Security requirements on cloud service providers and mission owners – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3

DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.3.2: Change control: security impact analysis and 30-day notice of significant changes to DISA

What does 5.3.2 require?

Before a planned significant change to the CSO, the CSP performs a security impact analysis that also covers the FedRAMP+ controls and the cyberspace defence requirements, gives DoD 30 days' notice as it does FedRAMP, includes all FedRAMP+ controls in the post-change assessment with a corresponding security assessment report, and routes change requests to DISA as well as to the FedRAMP authorizing official so that the DoD PA can be reviewed, conditioned or, if the change warrants it, withdrawn.

Maintained by Gerard Blokdyk

Other controls in Section 5: Security requirements on cloud service providers and mission owners – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 controls