No Longer Cloudy: DoD Issues New Guidance On FedRAMP Moderate Equivalency Cloud Security Requirements

The Department of Defense (DoD) recently published a memorandum clarifying what it means for a cloud service provider (CSP) to be Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline "equivalent" and meet incident reporting requirements under Defense Federal Acquisition Regulation Supplement (DFARS) Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 7012). The memorandum states, in order to be considered FedRAMP equivalent going forward, CSPs must (1) be FedRAMP Moderate/High-Authorized, or (2) secure a third-party assessment confirming their compliance with all FedRAMP Moderate baseline security controls.

DFARS 7012 states that contractors must ensure that an external CSP meets security requirements equivalent to the FedRAMP Moderate baseline before contractors may use a CSP to process, store, or transmit Covered Defense Information (CDI). See DFARS 252.204-7012(b)(2)(ii)(D).