Attachment_3_-_Government_Reference_Document.pdf

1. Department of Defense Directive 1350.4, Legal Assistance Matters, Certified Current as of December 1, 2003.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/135004p.pdf

2. Department of Defense Cloud Computing Security Requirements Guide (SRG), Version 1, Release 1, 12 January 2015. https://iase.disa.mil/cloud_security/Documents/u-cloud_computing_srg_v1r1_final.pdf

3. Executive Order 13526: Classified National Security Information, dated 29 December 2009.

http://www.archives.gov/isoo/policy-documents/cnsi-eo.html

4. Executive Order 12829 – National Industrial Security Program, dated January 1993.

http://www.archives.gov/isoo/policy-documents/eo-12829.html

5. NIST SP 500-292: NIST Cloud Computing Reference Architecture, dated September 2011.

http://www.nist.gov/customcf/get_pdf.cfm?pub_id=909505

6. NIST SP 800-53: Recommended Security Controls for Federal Information Systems and Organizations, Revision 4, dated April 2013.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf Note: http://csrc.nist.gov/publications/PubsSPs.html contains additional documents relating to SP 800-53.

7. NIST SP 800-59: Guideline for Identifying an Information System as a National Security System, dated August 2003. http://csrc.nist.gov/publications/nistpubs/800-59/SP800-59.pdf

8. NIST SP 800-66, Revision 1: An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, dated October 2008.

http://csrc.nist.gov/publications/nistpubs/800-66-Rev1/SP-800-66-Revision1.pdf

9. NIST SP 800-88, Revision 1: Draft: Guidelines for Media Sanitization, dated September 2012. http://csrc.nist.gov/publications/drafts/800-88-rev1/sp800_88_r1_draft.pdf

10. NIST SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), dated April 2010. http://csrc.nist.gov/publications/nistpubs/800-122/ sp800- 122.pdf

11. NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing, dated December 2011. http://csrc.nist.gov/publications/nistpubs/800-144/SP800-144.pdf

12. NIST SP 800-145: The NIST Definition of Cloud Computing, dated September 2011. http:// csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf

13. NIST SP 800-37, Revision 1: Guide for Applying the Risk Management Framework to Federal Information Systems, dated February 2010.

http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

14. CNSS Instruction 4009: National Information Assurance (IA) Glossary, dated 30 April 2010. . https://www.cnss.gov

15. CNSS Instruction 1253: Security Categorization and Control Selection for National Security Systems, dated 27 March 2014. https://www.cnss.gov

16. CNSS Instruction No.1253F, Attachment 5: Classified Information Overlay dated 09 May 2014. https://www.cnss.gov

17. CNSS Instruction No.1253F, Attachment x: Privacy Overlay dated TBD.

https://www.cnss.gov (when available)

18. DoD Chief Information Officer, Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services, 15 December 20014.

http://iase.disa.mil/Documents/commercial_cloud_computing_services.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/135004p.pdf https://iase.disa.mil/cloud_security/Documents/u-cloud_computing_srg_v1r1_final.pdf https://iase.disa.mil/cloud_security/Documents/u-cloud_computing_srg_v1r1_final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

19. DoD Instruction 8500.01: Cybersecurity, dated 14 March 2014.

http://dtic.mil/whs/directives/corres/pdf/850001_2014.pdf

20. DoD Instruction 8510.01: Risk Management Framework (RMF) For DoD Information Technology (IT), dated 12 March 2014.

http://dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

21. DoD Instruction 8520.03: Identity Authentication for Information Systems, dated 13 May, 2011. http://dtic.mil/whs/directives/corres/pdf/852003p.pdf

22. DoD Instruction O-8530.2, "Support to Computer Network Defense (CND)", March 9, 2001.

https://whsddpubs.dtic.mil/corres/pdf/O85302p.pdf (PKI requiredd)

23. DoD Instruction 5220.22: National Industrial Security Program, dated March 2011.

http://www.dtic.mil/whs/directives/corres/pdf/522022p.pdf

24. DoD Instruction 5200.02: DoD Personnel Security Program (PSP), Change 1 dated September 2014 http://www.dtic.mil/whs/directives/corres/pdf/520002_2014.pdf

25. DoD Manual 5220.22 Manual: National Industrial Security Program: Operating Manual (NISPOM), dated march 2013. http://www.dtic.mil/whs/directives/corres/pdf/522022m.pdf

26. DoD Instruction 5200.01: DoD Information Security Program and Protection of SCI, dated June 2011. http://www.dtic.mil/whs/directives/corres/pdf/520001p.pdf

27. DoD Manual 5200.01 Vol 1: DoD Information Security Program: Overview, Classification and Declassification, dated February 2012.

http://www.dtic.mil/whs/directives/corres/pdf/520001_vol1.pdf

28. DoD Manual 5200.01 Vol 2: DoD Information Security Program: Marking of Classified Information, dated March 2013.

http://www.dtic.mil/whs/directives/corres/pdf/520001_vol2.pdf

29. DoD Manual 5200.01 Vol 3: DoD Information Security Program: Protection of Classified Information, dated March 2013.

http://www.dtic.mil/whs/directives/corres/pdf/520001_vol3.pdf

30. DoD Manual 5200.2-R: Personnel Security Program, dated February 1996.

http://www.dtic.mil/whs/directives/corres/pdf/520002r.pdf

31. CJCSM 6510.01B: Chairman of the Joint Chiefs of Staff Manual: Cyber Incident Handling Program, dated 10 July 2012. http://www.dtic.mil/cjcs_directives/cdata/unlimit/m651001.pdf

32. DSS Facility Clearance Branch http://www.dss.mil/isp/fac_clear/fac_clear.html

33. DoD ECA PKI Certificate: http://iase.disa.mil/pki/eca/Pages/index.aspx

34. OPM Position Designation System 2010: . http://www.opm.gov/investigations/background-investigations/position-designation-tool/oct2010.pdf

35. Federal Risk and Authorization Management Program (FedRAMP) Home Page http://cloud.cio.gov/fedramp

36. FedRAMP Control Specific Contract Clauses v2, June 6, 2014;

http://cloud.cio.gov/document/control-specific-contract-clauses

37. Defense Information Systems Agency, the Security Technical Implementation Guide (STIG)

Home Page. http://iase.disa.mil

38. Defense Information Systems Agency, DoD Cloud Services Support website.

http://disa.mil/Services/DoD-Cloud-Broker http://www.dtic.mil/whs/directives/corres/pdf/520001_vol2.pdf

VIII. REFERENCES: