DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.6.2: CSP personnel: US citizenship or nationality at Levels 4 and 5, position categorisation, background investigations, clearances at Level 6, training

What does 5.6.2 require?

CSP personnel with logical or physical access to Level 4 and 5 systems or information must hold US citizenship, US national status or, where the level allows, lawful permanent residence (US citizens at Level 5 for certain roles and at Level 6); the CSP assigns a risk designation to every position under PS-2 (ADP-1, ADP-2, ADP-3) and screens individuals before granting access under PS-3 with investigations meeting OPM requirements for the designation, or demonstrates an equivalent, to receive a PA at Levels 2, 4 and 5; at Level 6 the CSP holds a facility clearance with cleared personnel under NISP. CSPs and mission owners comply with DoD 8570.01-M (the cybersecurity workforce programme) at Level 6, and CSPs at every level train security personnel as the baseline requires; mission owners review the CSP's personnel measures when accepting risk.