DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3
DISA's security requirements for cloud services holding DoD data: the FedRAMP+ baseline by impact level, US jurisdiction and tenant separation, DoD data ownership, continuous monitoring and change notice, DoD PKI, STIGs, facility and personnel vetting, spill, off-boarding and media rules, cloud access points and network separation, encryption at rest with DoD keys, registration and supply chain duties, and the cyberspace defence, incident reporting and forensics obligations on providers and mission owners.
DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 is a compliance framework from United States with 2 domains and 29 controls. The largest domains are Section 5: Security requirements on cloud service providers and mission owners – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 (24 controls), Section 6: Cyberspace defense and incident response – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (2)
Section 5: Security requirements on cloud service providers and mission owners – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3
| Code | Title |
|---|---|
| dod-cloud-computing-srg::5.1 | Apply the FedRAMP baseline plus the DoD FedRAMP+ controls and parameter values for the impact level |
| dod-cloud-computing-srg::5.10.1 | Connect to DoD networks only through an approved Cloud Access Point: NIPRNet BCAP for off-premises Level 4 and 5, ICAP for on-premises, SIPRNet rules for Level 6 |
| dod-cloud-computing-srg::5.10.2 | Network planes: separate management and user or data planes, encrypted management traffic, VPNs and audited management transactions |
| dod-cloud-computing-srg::5.10.3 | Service architecture: CSP-provided defence in depth for IaaS and PaaS, SaaS assessed as a whole, disaster recovery replication over private or IPsec-protected paths |
| dod-cloud-computing-srg::5.10.4 | IP addressing and DNS: DoD address space via the BCAP, no Internet reachability of NIPRNet-only services, .mil records in DoD DNS with DNSSEC |
| dod-cloud-computing-srg::5.10.5-6 | Mission owner duties using SaaS and IaaS or PaaS: defence in depth, STIGs, CSSP alignment, encryption at rest with DoD keys, one-way AD trusts |
| dod-cloud-computing-srg::5.11 | Encryption of data at rest with exclusive DoD control of keys |
| dod-cloud-computing-srg::5.12 | Backups: CSP backups under CP-9, mission owner responsibility and off-CSP copies for higher impact data |
| dod-cloud-computing-srg::5.13-14 | DoD contractors and mission partners using CSOs; test and development zones in the cloud |
| dod-cloud-computing-srg::5.15-17 | Ports, protocols and services registration, mobile code restrictions, and system registration and connection approval |
| dod-cloud-computing-srg::5.18 | Supply chain risk management plan and component authenticity |
| dod-cloud-computing-srg::5.19 | Electronic mail protections: DoD email hygiene and routing rules for cloud-hosted mail |
| dod-cloud-computing-srg::5.2.1 | Keep DoD data under exclusive US legal jurisdiction and list every storage location |
| dod-cloud-computing-srg::5.2.2 | Separation requirements by impact level: virtual separation at Level 4, dedicated government community infrastructure at Level 5, classified facilities at Level 6 |
| dod-cloud-computing-srg::5.2.3 | DoD owns all DoD data in the CSO, including logs; the CSP may not use it |
| dod-cloud-computing-srg::5.3.1 | Continuous monitoring after the PA: scans, annual assessment, reporting to DISA |
| dod-cloud-computing-srg::5.3.2 | Change control: security impact analysis and 30-day notice of significant changes to DISA |
| dod-cloud-computing-srg::5.4 | DoD PKI: CAC or alternate token for DoD users, DoD or NSS certificate revocation checking, PK-enabled portals, two-factor for CSP privileged users |
| dod-cloud-computing-srg::5.5 | Apply DoD SRGs and STIGs: mission owners for their systems at all levels, CSPs on dedicated DoD infrastructure |
| dod-cloud-computing-srg::5.6.1 | Facilities: FedRAMP Moderate physical security at Level 2, plus FedRAMP+ physical controls at Levels 4 and 5, cleared secure facilities at Level 6 |
| dod-cloud-computing-srg::5.6.2 | CSP personnel: US citizenship or nationality at Levels 4 and 5, position categorisation, background investigations, clearances at Level 6, training |
| dod-cloud-computing-srg::5.7 | Data spill handling: report, remediate across all copies, cryptographic erase or prescribed sanitisation |
| dod-cloud-computing-srg::5.8 | Off-boarding: return all mission data and audit logs in a usable format, then cryptographically erase and certify destruction |
| dod-cloud-computing-srg::5.9 | Media sanitisation before reuse or disposal: purge to NIST SP 800-88 at Levels 4 and 5, destroy where purge is uncertain |
Section 6: Cyberspace defense and incident response – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3
| Code | Title |
|---|---|
| dod-cloud-computing-srg::6.1-4 | Cyberspace defence roles: boundary defence by DISA, mission defence by the mission owner's CSSP, CSP cooperation with DoD defenders |
| dod-cloud-computing-srg::6.5.1 | Incident response plan or DoD addendum covering all incidents and breaches with notice to the government |
| dod-cloud-computing-srg::6.5.2-3 | Incident reporting: categories, timelines, formats and the reporting mechanism to DoD |
| dod-cloud-computing-srg::6.5.4 | Digital forensics: capture, preserve and protect incident information with hashes, encryption, segregation and chain of custody for law enforcement |
| dod-cloud-computing-srg::6.6-6.10 | Act on DoD directives, meet POA&M remediation timelines, notify scheduled outages, use PKI for defence communications, share vulnerability and threat information |
What is DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 and who does it apply to?
DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 is a compliance framework from United States with 2 domains and 29 controls. DISA's security requirements for cloud services holding DoD data: the FedRAMP+ baseline by impact level, US jurisdiction and tenant separation, DoD data ownership, continuous monitoring and change notice, DoD PKI, STIGs, facility and personnel vetting, spill, off-boarding and media rules, cloud access points and network separation, encryption at rest with DoD keys, registration and supply chain duties, and the cyberspace defence, incident reporting and forensics obligations on providers and mission owners. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 actually require?
DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 has 29 controls organised across 2 domains. The largest domains are Section 5: Security requirements on cloud service providers and mission owners – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 (24 controls), Section 6: Cyberspace defense and incident response – DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 do I already cover?
DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3?
Start your DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 29 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required