NIST SP 800-53 and Federal Risk and Authorization Management Program (FedRAMP) baselines provide the foundation of security controls required for cloud-based systems. Additional controls may be required pending mission specifics and data to be processed or stored. If the CSO is already FedRAMP authorized or is undergoing an initial FedRAMP authorization with IL uplift, then the CSP must utilize the DoD FedRAMP+ Security Controls and DISA Parameters for the desired impact level. The specific FedRAMP+ Security Controls are listed within table D-1 of the CSP SRG (a component of the CC SRG). Furthermore, a full listing of controls that need to be tested for ILs 4, 5, and 6 can be specifically found within the DoD Cloud Computing Security (DCCS) Document Library (https://public.cyber.mil/dccs/dccs-documents/) within the DoD Rev 5 SSP Addendum Controls.

As a quick overview to the addendum, the following controls are required for ILs 2, 4, 5, and 6 authorization. Please note, if the mission owner determines that the information system is processing, storing, or transmitting data pertaining to a national security system (NSS), additional NSS controls may be required as part of authorization.

• Impact Level 2: Impact Level 2 information, which includes non-controlled unclassified information, is all data cleared for public release and non-critical mission information. IL2 data may be hosted within a CSO that holds a FedRAMP Moderate or High Provisional Authority to Operate (P-ATO).
• Impact Level 4: Impact Level 4 accommodates controlled unclassified information (CUI) categorizations based on the CNSS Instruction No. 1253 (CNSSI 1253), Security Categorization and Control Selection for National Security Systems, up to moderate confidentiality and moderate integrity. A CSO looking to achieve IL4 authorization must be compliant with all FedRAMP moderate controls, DISA Parameters, and the additional FedRAMP+ controls listed within table D-1 of the CSP SRG.
• Impact Level 5: Impact Level 5 accommodates nonpublic, unclassified NSS data or nonpublic, unclassified data where the unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. A CSO looking to achieve impact level 5 authorization must be compliant with all FedRAMP high controls, DISA Parameters, and the additional FedRAMP+ controls listed within table D-1 of the CSP SRG.
• Impact Level 6: Impact Level 6 data can be defined as information and data systems that are classified as critical to national security and require maximum protection from unauthorized access or manipulation. A CSO looking to achieve impact level 6 authorization must be compliant with all FedRAMP high controls, DoD Parameters, the CNSSI 1253 Classified Information Overlay, and the additional FedRAMP+ controls listed within table D-1 of the CSP SRG.
• Impact Level 5/6 and NSS: The security requirements to achieve impact level 5 and 6 authorization requirements are designed to accommodate NSS. Additional NSS-specific security controls for a CSO must be assessed for any impact level containing NSS information. The applicability of additional NSS controls is ultimately up to the Authorization Official. For impact level 5, a CSP may achieve impact level 5 authorization for their CSO with or without additional NSS requirements. IL5 NSS and IL5 non-NSS requirements are listed within the DoD Rev 5 SSP Addendum Controls.