STIGQter: STIG Summary: Cloud Computing Mission Owner Network Security Requirements Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must implement a security stack that restricts traffic flow inbound and outbound between the IaaS and the Boundary Cloud Access Point (BCAP) or Internal Cloud Access Point (ICAP) connection.

DISA Rule

SV-259863r945577_rule

Vulnerability Number

V-259863

Group Title

SRG-NET-000205

Rule Version

SRG-NET-000205-CLD-000085

Severity

CAT I

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

FedRAMP Moderate, High.

For dedicated infrastructure with an ICAP/BCAP connection (Levels 4–5 and on-premise Impact Level 2), ensure the IaaS/PaaS implements a security stack that restricts traffic flow inbound and outbound between the IaaS/PaaS and the BCAP or ICAP connection.

Check Contents

If this is an Impact Level 2 IaaS/PaaS implementation, this requirement is not applicable.

Review the architecture for the IaaS.

Verify that for dedicated infrastructure mission Impact Levels 4–5, the IaaS implements a security stack that restricts traffic flow inbound and outbound between the IaaS/PaaS and the BCAP or ICAP connection.

For IaaS Levels 4–5, if the IaaS does not implement a security stack that restricts traffic flow inbound and outbound between the IaaS/PaaS and the BCAP or ICAP connection, this is a finding.

Vulnerability Number

V-259863

Documentable

False

Rule Version

SRG-NET-000205-CLD-000085

Severity Override Guidance

If this is an Impact Level 2 IaaS/PaaS implementation, this requirement is not applicable.

Review the architecture for the IaaS.

Verify that for dedicated infrastructure mission Impact Levels 4–5, the IaaS implements a security stack that restricts traffic flow inbound and outbound between the IaaS/PaaS and the BCAP or ICAP connection.

For IaaS Levels 4–5, if the IaaS does not implement a security stack that restricts traffic flow inbound and outbound between the IaaS/PaaS and the BCAP or ICAP connection, this is a finding.

Check Content Reference

M

Target Key

5583