DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.4: DoD PKI: CAC or alternate token for DoD users, DoD or NSS certificate revocation checking, PK-enabled portals, two-factor for CSP privileged users

What does 5.4 require?

CSPs integrate with DoD PKI as the DoD implementation of PIV, FIPS 201 and HSPD-12: DoD privileged users authenticate to CSP and mission system interfaces with the Common Access Card or an alternate token, non-privileged users with DoD-approved credentials, and the CSP checks revocation through DoD OCSP or CRL resources and follows DoD rules for managing and protecting certificates and keys (NSS PKI, OCSP and CRL resources and CNSS policy at Level 6). Customer ordering and service management portals are PK-enabled for DoD users. CSP privileged users use at least two-factor authentication to the CSO, with dedicated identity and authentication infrastructure for dedicated Level 5 infrastructure and CNSS-compliant credentials at Level 6; Table 5.4 sets the credential strength and authentication methods for mission owners and CSPs by level.