STIGQter: STIG Summary: Cloud Computing Mission Owner Operating System Security Requirements Guide Version: 1 Release: 3 Benchmark Date: 13 Aug 2025:

The Mission Owners must select and configure a cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog at Level 6 when hosting classified DOD information.

DISA Rule

SV-259887r959010_rule

Vulnerability Number

V-259887

Group Title

SRG-OS-000480

Rule Version

SRG-OS-000480-CLD-000033

Severity

CAT I

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

This applies to Impact Level 6.
FedRAMP Moderate, High.

Configure a cloud service offering listed in the DISA PA DOD Cloud Catalog for use with Impact Level 6 when hosting classified DOD information.

Specify in the Service Level Agreement (SLA) with the CSP and third-party providers compliance with applicable STIG configurations.

Check Contents

If the implementation is categorized as Impact Level 2–5, this is not applicable.

Review the approval documentation and the DISA PA Cloud Catalog. Verify the CSO is listed in the DISA PA DOD Cloud Catalog. Verify the CSO is listed in the DISA PA DOD Cloud Catalog at Level 6 when hosting classified DOD information.

If classified DOD information is being hosted in the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) and the CSO is not listed in the DISA PA DOD Cloud Catalog, Impact Level 6, this is a finding.

The Mission Owners must select and configure a cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog at Level 6 when hosting classified DOD information.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key