DoD Cloud Computing Security Requirements Guide (SRG)

Why does it matter?

A cloud offering cannot simply be bought for DoD data because it is secure in general: it must hold a DoD PA for the Impact Level of the information, and the PA is granted for a specific cloud service offering, not for the provider as a whole (CSP SRG section 3.6). The SRG explains what the DoD checks and what the provider keeps doing afterward.

Key benefits include:

• Authorization before award

Off-premises commercial services need a DoD PA at the appropriate Impact Level before contract award, or evidence that one can be achieved (section 4.5).

• Impact Levels match data sensitivity

Levels 2, 4, 5 and 6 range from publicly releasable data to classified information up to SECRET (section 3.7).

• U.S. data location

DoD data not on DoD premises stays in the 50 states, the District of Columbia and outlying areas unless the authorizing official approves otherwise (section 5.2.1).

• Fast incident reports

Initial incident reports are due within one hour of the provider's triage deciding the incident is reportable (section 6.2.2).

• Authorization can be revoked

A PA is revocable if the offering loses its FedRAMP authorization or the provider does not meet DoD requirements (section 3.6).

How does it work?

The SRG builds on FedRAMP. It uses the FedRAMP Moderate or High baselines through reciprocity and adds the DoD's own FedRAMP+ controls and parameter values (Appendix D). A provider with a FedRAMP provisional authorization or a federal agency authorization requests a DoD PA; offerings inherit the posture of any cloud offering they run on, and subcontracted offerings must be disclosed (section 3.6).

The Mission Owner, the DoD team that runs the workload, categorizes its system under DoDI 8510.01 and CNSSI 1253, picks the Impact Level and decides how to meet its own technical requirements. These are set in the Cloud Computing Mission Owner SRG, and the Mission Owner and provider share responsibility by service type (section 4.3).

After authorization the provider keeps up the same continuous monitoring as FedRAMP, such as annual assessments and monthly vulnerability scans, with extra information for the DoD controls (section 5.3.1), and follows incident reporting rules (section 6).

Key Elements

• Information Impact Levels (section 3.7)

Impact Level 2 is non-controlled unclassified information, Level 4 is controlled unclassified information, Level 5 adds controlled unclassified information and unclassified National Security Systems, and Level 6 is classified information up to SECRET. Impact Levels are a DoD construct and are not FedRAMP levels.

• DoD Provisional Authorization (sections 3.6 and 4)

The PA acknowledges risk from a specific offering, is granted at all Impact Levels and is the foundation that authorizing officials use for each mission application.

• FedRAMP+ controls (section 5.1 and Appendix D)

DoD adds controls, enhancements and parameter values to the FedRAMP baseline, and National Security Systems need at least the FedRAMP High baseline.

• Data ownership and location (section 5.2)

Covers legal jurisdiction, separation between Impact Levels, the provider's use of DoD data and data protection.

• Architecture and connectivity (section 5.9)

Defines the Cloud Access Point, network planes, service architecture, addressing and hybrid interconnections.

• Cyberspace defense and incident response (section 6)

Sets incident reporting categories, timelines and mechanisms, support for law enforcement, tactical directives and insider threat monitoring.

What does it cover?

The SRG applies to commercial and non-DoD federal providers, DoD programs operating as providers, and DoD components and Mission Owners using DoD or commercial cloud services, for information from publicly releasable up to SECRET. Missions above SECRET follow other DoD policy. The guide does not cover every DoD system, only those that move to or use cloud services.

What are its objectives?

The SRG lets DoD place data in cloud services without accepting unmanaged risk.

Define security controls and requirements for providers that host DoD missions.

Match each workload to an Impact Level that reflects data sensitivity and potential impact.

Base DoD approval on FedRAMP plus the DoD's own controls, so providers do not assess twice.

Keep authorized offerings secure through continuous monitoring, annual assessment and incident reporting.

Make provider and Mission Owner responsibilities explicit.

Framework in Context

The SRG sits between FedRAMP and the DoD risk management process. The CSP SRG supports DoDI 8510.01 and uses NIST SP 800-53 requirements through the FedRAMP baselines, and DFARS 239.76 requires the PA before award. It is separate from DFARS 252.204-7012, which protects covered defense information on contractor systems, though that clause points cloud providers handling covered information to FedRAMP Moderate equivalence.

Common Framework Mappings

Organizations map DoD SRG controls to other mature frameworks to simplify authorization, demonstrate continuous compliance, and use established controls across cloud, federal, and industry security programs.

Mapped frameworks include:

Cloud Security Alliance Cloud Controls Matrix

Cybersecurity Maturity Model Certification (CMMC)

FedRAMP (Federal Risk and Authorization Management Program)

ISO/IEC 27001

ISO/IEC 27017

NIST SP 800-171

NIST SP 800-53

SOC 2