The DoD CSP SRG and DoD MO SRG: A Breakdown

Now that the DoD Cloud Computing Security Requirements Guide (SRG) v1r4 has been officially retired, cloud service providers (CSPs) will need to familiarize themselves with the two new documents that have replaced those requirements—the latest DoD CSP SRG v1r1 and DoD Mission Owner (MO) SRG—to maintain compliance with applicable mandates.

As a leading third-party assessment organization (3PAO) of assessments on the FedRAMP Marketplace and providers of various other federal assessments, we’re well-entrenched in these requirements for cloud service providers, which we know can be quite dense—no matter if you’re looking to do business with the government or you’ve already dealt with them before.

It may never seem to get any less challenging, but as experts, we’re here to help you with this latest transition. In this article, we will review four key differences between the old version of the SRG and the new one(s) so that you can have a solid launch point to make any necessary adjustments.

4 Key Updates to the DoD CSP SRG

Though we recommend reading through both documents yourself for a more thorough understanding, we’ve identified the following five differences between the old version of the DoD SRG and the new:

• Separation of document audience
• New reciprocity between FedRAMP baselines and DoD Impact Levels
• Inclusion of DoD’s right-to-penetration testing for Impact Level 6
• Key control changes

1. Separation of Document Audience

Let’s start with the most obvious change—in the newest version of the DoD SRG, the guidance is split into two different documents:

• DoD CSP SRG v1r1: Contains security requirements CSPs must adhere to in order to provide their cloud service offerings (CSOs) to DOD Mission Owners; and

• DoD MO SRG: Contains technical requirements mandated for the Mission Owner (MO), or, the organization that will use the CSP’s product for their business use cases.
  • NOTE: MOs who host their cloud workloads in CSP infrastructure must also review and comply with the CSP SRG.

Despite this separation, these documents will inform each other, as it’ll be up to customers to determine from their Mission Owner guide what they may want to enforce on the CSP regarding their cloud offering.

2. New Reciprocity Between FedRAMP Baselines and DoD Impact Levels

In another change, the new CSP SRG has now defined reciprocity between FedRAMP baseline Risk Assessments and specific impacts—i.e., how your FedRAMP Authorization for a federal agency translates and assists in meeting the DoD’s specific IL4, IL5, and IL6.

Why does this matter?

Though the DoD has previously acknowledged and accepted reciprocity between FedRAMP Moderate / High and IL2, and the new version of the CC SRG expands upon this reciprocity to IL4, 5, and 6—now, CSPs can use these baselines or even draw on their existing FedRAMP ATO to reduce their assessment package workload, as long as they add the controls and parameters in Appendix D of the CSP SRG.

More specifically, here’s what’s required to be able to leverage that new reciprocity:

3. Penetration Testing for IL6

Speaking of IL6, the DoD has added verbiage in the new SRG that gives them the right to perform internal and external penetration testing on CSP IL6 hosting environments.

Before, CSPs were solely responsible for defining and running the requisite penetration testing for IL6 3PAO assessments—the DoD would just shadow the 3PAO chosen by the CSP to run the tests. While that’s still true, this new language now means the DoD also reserves the right to perform its own, additional penetration testing whenever they choose to (though if they do choose to, they will coordinate with the CSP involved).

(As this is singular to IL6, this likely won’t impact many CSPs; however, if you’re planning to uplift to an IL6 or are developing an IL6 offering, it’s important to know that the DoD holds its right to penetration testing at any time now—though they’ll still need to coordinate with you.)

4. Security Control Changes Between the Previous SRG and the New CSP SRG

Now that we’ve mentioned Appendix D, we can get into our final key update—the changes made to its control sets in the new version of the SRG.

Controls Removed:

The following table is a list of controls that were removed from Appendix D of the Cloud Computing (CC) SRG:

Control Parameters Remaining:

Without those controls, we’re left with the following which are either new controls and/or new control parameters. This table outlines DoD specifically identified controls, their parameters, and the IL to which they are applicable as additions or amendments to the FedRAMP baselines. (We have also emphasized controls not covered by FedRAMP Moderate or High Baselines, and thus are additional control requirements for DoD.)

*Note: At the time of this blog, DSPAVs were based on the parameters set in the CNSSI 1253 from July 29th, 2022.

Please note that these controls do not include the overlays, Contract, or Service Level Agreement (SLA) controls that each specific MO can impose at their discretion—for more information, those controls can be found in the MO SRG.

A Word About NSS and Non-NSS

Because most IL5 offerings tend to be Non-NSS, the identified controls and parameters in our above table do not include any specific details for those that are or are going to be an NSS.

That being said, the DoD has provided an Excel spreadsheet breakdown of the applicable controls for IL2 through 6 that does include NSS and Non-NSS baselines for IL5. Despite this spreadsheet not being explicitly provided within the new DoD SRG package, the DoD may impose approximately 178 additional controls and parameters for any system classified as IL5 and NSS. Should that happen, this would significantly change many factors regarding CSP offerings and 3PAO assessments such as the CSP’s implementation of the controls, as well as the 3PAO’s assessment scope and timeline.

As such, please make sure that you confirm with your DoD representative if your offering will be classified as an NSS and work with them to ensure a comprehensive control selection for your 3PAO assessments.

The Timeline for Transition to the New DoD CSP SRG

Now that you understand more about the new DoD CSP SRG, you need to know when you’ll need to transition to its mandates:

• For CSPs with an existing IL 5/6/NSS Authority to Operate (ATO), the DoD has decreed that you’ll have no later than the end of the calendar year 2025 to update to NIST SP 800-53 Rev 5 requirements in this SRG.

• For CSPs with existing ATOs, you must submit a Plan of Action and Milestones (POA&M) outlining actions needed to comply with the requirement to move to the High baseline within 30 days of publication of the SRG.

• For CSPs in the process of obtaining an ATO, we recommend reaching out to your DoD Sponsor/AO for guidance on their expectations for your service offering to meet or transition to this new guidance.

As cloud service providers do transition to the new version of the DoD SRG, a complete understanding of all the changes within this latest release will be critical. We hope that this breakdown of some of the key updates will provide a helpful leg up, but should you have any further questions or concerns, don’t hesitate to reach out to us, as our team of experts is standing by ready to assist.