V-259885
Cloud Computing Mission Owner Operating System Security Requirements Guide
Title
The Mission Owner must select and configure an Impact Level 4/5 cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog when hosting Controlled Unclassified Information (CUI).
Description
<VulnDiscussion>Impact Level 4 accommodates Controlled Unclassified Information (CUI). This information must be protected from unauthorized disclosure. Designating information as CUI is the responsibility of the data owner and their organization. Determining the appropriate Impact Level for a specific mission with CUI will be the responsibility of the mission AO. Impact Level 5 accommodates CUI that requires a higher level of protection as deemed necessary by the information owner, public law, ...
Fix Text (Documentation Requirement)
This applies to Impact Level 4/5. FedRAMP Moderate, High. For CUI information, select and configure a CSO listed in the DISA PA DOD Cloud Catalog for use with Impact Level 4/5 or higher. Specify in the Service Level Agreement (SLA) with the cloud service provider (CSP) and any third-party providers compliance with applicable STIG configurations.