DOD cloud consumers may seek support from the DISA Cloud Services Support office to fulfill their cloud service requirements. The DISA Cloud Services Support Office (CSSO) uses the initial contact forms (DOD Cloud IT Project Initial Contact Form) to collect information from cloud consumers about their cloud service requirements and and work with them through the process of registering their C-ITP with the DISA Connection Approval Office and/or connecting their C-ITP to the DISA Cloud Access Point (CAP).
If a mission need cannot be met by a cloud service offering (CSO) already in the catalog, the mission owner may request a new CSO be assessed for supporting DOD missions and sponsor the DOD assessment. When a Cloud Service Provider (CSP) submits a request for a DOD assessment on the new CSO, the CSP needs to complete the following templates:
The CSP provides these documents and artifacts listed in the CSP Security Package Documentation Checklist, and forwards the required documents and artifacts to the DISA Cloud Assessment Team. (See Appendix D, Table 7 of the DOD Cloud Connection Process Guide [CCPG] for DISA Cloud Assessment Team contact information.)
The Cloud Support Services team will evaluate the submitted material. If the CSO is ready for assessment, the Cloud Support Services team will prioritize the request and schedule available resources for the assessment. These general guidelines are used to establish assessment priority, in order from greatest to least priority:
- Top Priority: CSPs with a DOD sponsor that supports a high priority DOD mission as recognized by a DOD chief information officer or J6 general officer. In the event multiple CSPs fall into this category, resolution of priorities will be determined by a designated Secretary of Defense (SecDef) or Joint Chiefs of Staff (JCS) senior.
- CSP renewing an expiring provisional authorization (PA) that currently hosts DOD IT projects.
- CSP with a DOD sponsor with these prerequisites:
(1) CSP has completed the Federal Risk and Authorization Management Program (FedRAMP) process.
(2) CSP has an existing contract.
(3) CSP rates high on readiness checklist.
(4) CSP sponsor has an information assurance (IA) resource to help with the analysis of the Third Party Assessment Organization’s (3PAO) assessment products.
- CSP with DOD sponsor currently operating in a DOD private cloud scenario that has a second DOD sponsor seeking its services.
- CSP with a DOD sponsor not meeting the above conditions.
- Lowest Priority: CSPs that do not have a DOD sponsor, but do have a capability aligned to a recognized DOD interest.
When a CSP-CSO receives its DOD-approved provisional authorization (PA), the DOD mission owner is permitted to register/connect the now-authorized CSP-CSO to host its mission C-ITP.
The Cloud Support Services team will evaluate the mission owner’s C-ITP submitted material, prioritize the request, and schedule available resources for the C-ITP’s connection to CSP-CSO. These general guidelines are used to establish connection priority, in order from greatest to least priority:
- Top Priority: C-ITPs supporting a high priority DOD mission as recognized by a DOD chief information officer or J6 general officer. In the event multiple CSPs fall into this category, resolution of priorities will be determined by a designated SecDef or JCS senior.
- Renewing the Cloud Permission to Connect for a C-ITP that currently hosts operational users and is due to expire within 120 days (DISA Boundary Cloud Access Point [BCAP]).
- C-ITPs transitioning a system from a full operational environment (cloud or non-cloud) to a new cloud operational environment with consideration given to the mission owner’s target date of completion.
- C-ITP has been issued a Cloud Permission to Connect in support of an operational use with consideration given to the mission owner’s target date of completion.
- C-ITP has been issued a Cloud Permission to Connect in support of a formal test event.
- Lowest Priority: C-ITPs conducting an assessment with no authorized plan to go operational within a 12-month window