| Checked | Name | Title |
|---|
| ☐ | SV-259872r958362_rule | The Mission Owner must configure the customer service portal credentials for least privilege. |
| ☐ | SV-259873r958390_rule | The Mission Owner must configure the cloud service offering (CSO)-provided customer logon banner to display the Standard Mandatory DOD Notice and Consent Banner before granting access to users that must log on. |
| ☐ | SV-259874r1132412_rule | The Mission Owner must configure the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) to prohibit or restrict the use of functions, ports, protocols, and/or services. |
| ☐ | SV-259875r958482_rule | The cloud service offering (CSO) must be configured to use DOD public key infrastructure (PKI) to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). |
| ☐ | SV-259876r958754_rule | The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must perform centralized logging to capture and store log records. |
| ☐ | SV-259877r958804_rule | For Impact Levels 4 and 5, the Mission Owner must register all cloud-based services, their CSP/CSO, and connection method in the DISA Systems/Network Approval Process (SNAP) database Cloud Module. |
| ☐ | SV-259878r958804_rule | For Impact Level 6, the Mission Owner must process connection approval to the SIPRNet through the DISA classified connection approval process. |
| ☐ | SV-259879r958804_rule | The Mission Owner of the Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) must remove orphaned or unused virtual machine (VM) instances. |
| ☐ | SV-259880r958808_rule | The Infrastructure as a Service (IaaS)/Platform as a Service (PaaS)/Software as a Service (SaaS) must register the service/application with the DOD DMZ/IAP allowlist for internet-facing inbound and outbound traffic. |
| ☐ | SV-259881r958870_rule | For storage service offerings, the Mission Owner must configure or ensure the cloud instance uses encryption to protect all DOD files housed in the cloud instance. |
| ☐ | SV-259882r958938_rule | The Mission Owner of the Infrastructure as a Service (IaaS) or Platform as a Service (PaaS) must remove all upgraded or replaced software and firmware components that are no longer required for operation. |
| ☐ | SV-259883r959010_rule | The Mission owner must obtain Authorizing Official (AO) authorization for each cloud service offering (CSO) implemented in support of production or development environments prior to operational use. |
| ☐ | SV-259884r959010_rule | The Mission Owner must select and configure an Impact Level 2 FedRAMP authorized cloud service offering (CSO) when hosting unclassified, publicly releasable DOD information. |
| ☐ | SV-259885r959010_rule | The Mission Owner must select and configure an Impact Level 4/5 cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog when hosting Controlled Unclassified Information (CUI). |
| ☐ | SV-259886r959010_rule | The Mission Owner must select and configure an Impact Level 5 cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog when hosting Unclassified National Security Information (U-NSI). |
| ☐ | SV-259887r959010_rule | The Mission Owners must select and configure a cloud service offering (CSO) listed in the DISA Provisional Authorization (PA) DOD Cloud Catalog at Level 6 when hosting classified DOD information. |
| ☐ | SV-259888r1056071_rule | The Mission Owner must add all applicable compensating controls and requirements in the Service Level Agreement (SLA)/contract with the cloud service provider (CSP) or third-party provider. |
STIGQter: STIG Summary: