National Security Cloud Reference Studio

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. The DoD cloud security model uses impact levels to express information sensitivity and the security requirements expected of cloud offerings.

   Standardrequirementhttps://www.cyber.mil/dccs/dccs-documents/

2. Defines DoD cloud security requirements; does not grant a system ATO.

   Standardauthorizationhttps://www.cyber.mil/dccs/dccs-documents/

3. Not a service-availability statement.

   Standardavailabilityhttps://www.cyber.mil/dccs/dccs-documents/

4. Not an acquisition statement.

   StandardjwccOrderabilityhttps://www.cyber.mil/dccs/dccs-documents/

5. Mission-specific analysis remains required.

   StandardmissionSuitabilityhttps://www.cyber.mil/dccs/dccs-documents/

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. Microsoft documents separate government environments, region types, and additional isolation considerations for some IL5 workloads.

   Product documentationscopehttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-overview-dod

2. Provider-reported platform scope only.

   Product documentationauthorizationhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-overview-dod

3. Region and service availability require service-level verification.

   Product documentationavailabilityhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-overview-dod

4. No JWCC ordering claim is made.

   Product documentationjwccOrderabilityhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-overview-dod

5. No mission suitability claim is made.

   Product documentationmissionSuitabilityhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-overview-dod

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. Oracle documents US Defense Cloud as realm OC3 with three named regions; an OC3 tenancy can subscribe only to regions in that realm.

   Product documentationscopehttps://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm

2. Provider-reported environment boundary; no mission authorization is asserted.

   Product documentationauthorizationhttps://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm

3. Three named OC3 regions are documented; service and feature availability remain separate checks.

   Product documentationavailabilityhttps://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm

4. No acquisition or ordering-path claim is made.

   Product documentationjwccOrderabilityhttps://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm

5. No mission suitability claim is made.

   Product documentationmissionSuitabilityhttps://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. AWS identifies two isolated GovCloud (US) regions and documents a distinct partition, endpoints, account relationship, and credentials.

   Product documentationscopehttps://docs.aws.amazon.com/govcloud-us/latest/UserGuide/whatis.html

2. Provider-reported environment scope.

   Product documentationauthorizationhttps://docs.aws.amazon.com/govcloud-us/latest/UserGuide/whatis.html

3. Two named regions; service-level confirmation remains required.

   Product documentationavailabilityhttps://docs.aws.amazon.com/govcloud-us/latest/UserGuide/whatis.html

4. No ordering-path claim is made.

   Product documentationjwccOrderabilityhttps://docs.aws.amazon.com/govcloud-us/latest/UserGuide/whatis.html

5. No workload-fit claim is made.

   Product documentationmissionSuitabilityhttps://docs.aws.amazon.com/govcloud-us/latest/UserGuide/whatis.html

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. Google documents an IL4 control package with supported services, location controls, and customer prerequisites.

   Product documentationscopehttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il4

2. Provider-reported control-package scope.

   Product documentationauthorizationhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il4

3. Only the currently documented in-scope products and regions.

   Product documentationavailabilityhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il4

4. No JWCC ordering claim is made.

   Product documentationjwccOrderabilityhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il4

5. Customer prerequisites and mission constraints remain decisive.

   Product documentationmissionSuitabilityhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il4

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. Google states that a product not listed for Data Boundary for IL5 is unsupported for that package and may still share an API endpoint with supported products.

   Product documentationscopehttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il5

2. Provider-reported control-package scope; no government or mission authorization is asserted.

   Product documentationauthorizationhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il5

3. Only currently listed products are supported for this package; endpoint access is not a support signal.

   Product documentationavailabilityhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il5

4. No acquisition or ordering-path claim is made.

   Product documentationjwccOrderabilityhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il5

5. Customer and authorizing-agency review remain required.

   Product documentationmissionSuitabilityhttps://docs.cloud.google.com/assured-workloads/docs/control-packages/il5

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. NIST SP 800-37 Rev. 2 describes a system life-cycle risk-management process with explicit authorization and ongoing-monitoring activities.

   Standardrequirementhttps://csrc.nist.gov/pubs/sp/800/37/r2/final

2. The Authorizing Official retains the risk decision.

   Standardauthorizationhttps://csrc.nist.gov/pubs/sp/800/37/r2/final

3. Not a service-availability statement.

   Standardavailabilityhttps://csrc.nist.gov/pubs/sp/800/37/r2/final

4. Not an acquisition statement.

   StandardjwccOrderabilityhttps://csrc.nist.gov/pubs/sp/800/37/r2/final

5. RMF process does not prescribe a provider or architecture.

   StandardmissionSuitabilityhttps://csrc.nist.gov/pubs/sp/800/37/r2/final

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. Microsoft identifies services and configurations that require additional compute or storage isolation for IL5 use in some government regions.

   Authorization evidenceauthorizationhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5

2. Provider guidance is not a mission ATO.

   Authorization evidenceauthorizationhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5

3. Service availability is a separate source check.

   Authorization evidenceavailabilityhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5

4. No ordering-path claim is made.

   Authorization evidencejwccOrderabilityhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5

5. Required configuration and mission context must be assessed.

   Authorization evidencemissionSuitabilityhttps://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. AWS states that absence from its current DoD CSP scope table does not by itself mean a service cannot be used, and that some services sit outside DISA review without an approval or disapproval decision.

   Product documentationscopehttps://aws.amazon.com/compliance/services-in-scope/DoD/

2. Provider-reported assessment scope; mission approval and authorization remain external decisions.

   Product documentationauthorizationhttps://aws.amazon.com/compliance/services-in-scope/DoD/

3. The scope table does not establish current regional or feature availability.

   Product documentationavailabilityhttps://aws.amazon.com/compliance/services-in-scope/DoD/

4. No acquisition or ordering-path claim is made.

   Product documentationjwccOrderabilityhttps://aws.amazon.com/compliance/services-in-scope/DoD/

5. Shared-responsibility and mission review remain required.

   Product documentationmissionSuitabilityhttps://aws.amazon.com/compliance/services-in-scope/DoD/

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. DoD stated that the Software Modernization Strategy builds upon, evolves, and replaces the 2018 DoD Cloud Strategy.

   Strategyscopehttps://www.defense.gov/News/Releases/Release/Article/2924187/dod-software-modernization-strategy-approved/

2. Department strategy; no system authorization.

   Strategyauthorizationhttps://www.defense.gov/News/Releases/Release/Article/2924187/dod-software-modernization-strategy-approved/

3. No service-availability claim.

   Strategyavailabilityhttps://www.defense.gov/News/Releases/Release/Article/2924187/dod-software-modernization-strategy-approved/

4. No specific ordering claim.

   StrategyjwccOrderabilityhttps://www.defense.gov/News/Releases/Release/Article/2924187/dod-software-modernization-strategy-approved/

5. No workload-specific prescription.

   StrategymissionSuitabilityhttps://www.defense.gov/News/Releases/Release/Article/2924187/dod-software-modernization-strategy-approved/

These bounded claims preserve useful public detail while leaving governing requirements and adherence guidance in the linked source.

1. The memorandum describes JWCC as an acquisition vehicle rather than a hosting environment and gives covered components cloud-procurement direction.

   Policyrequirementhttps://dodcio.defense.gov/Portals/0/Documents/Library/NextStepRationalizeCloudUse.pdf

2. Acquisition policy for named organizational scope.

   Policyauthorizationhttps://dodcio.defense.gov/Portals/0/Documents/Library/NextStepRationalizeCloudUse.pdf

3. No claim about a specific CSP service.

   Policyavailabilityhttps://dodcio.defense.gov/Portals/0/Documents/Library/NextStepRationalizeCloudUse.pdf

4. Vehicle exists; item-level current orderability is not asserted.

   PolicyjwccOrderabilityhttps://dodcio.defense.gov/Portals/0/Documents/Library/NextStepRationalizeCloudUse.pdf

5. No mission-specific provider or service recommendation.

   PolicymissionSuitabilityhttps://dodcio.defense.gov/Portals/0/Documents/Library/NextStepRationalizeCloudUse.pdf