A client uses an external cloud-based service to store, process, or transmit data that is reasonably believed to qualify as CUI. According to DFARS…

The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting," directly addresses the security requirements for external cloud service providers (CSPs). Paragraph (b)(2)(ii)(D) of this clause mandates that if a contractor uses an external CSP to store, process, or transmit Covered Defense Information (CDI), which includes CUI, the contractor must ensure the CSP meets security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. This ensures a consistent and adequate level of protection for sensitive defense information hosted in the cloud.

A. FedRAMP Low: This impact level is insufficient for protecting CDI/CUI as DFARS 252.204-7012 explicitly specifies the Moderate baseline as the minimum requirement.

C. FedRAMP High: While a provider at this level would be compliant, it is not the minimum requirement established by the clause; FedRAMP Moderate is the specified baseline.

D. FedRAMP Secure: "FedRAMP Secure" is not an official impact level designation within the FedRAMP program. The established baselines are Low, Moderate, and High.

1. Defense Federal Acquisition Regulation Supplement (DFARS)

Clause 252.204-7012

Safeguarding Covered Defense Information and Cyber Incident Reporting (DEC 2019). Paragraph (b)(2)(ii)(D) states: "...the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline..."

2. U.S. Department of Defense

Chief Information Officer. "Frequently Asked Questions (FAQs) regarding DFARS Clause 252.204-7012 and NIST SP 800-171

" Version 1.1

January 27

2020. Question 49 directly confirms: "The security requirement for a cloud computing service is the FedRAMP Moderate baseline."

3. General Services Administration (GSA). "About FedRAMP." FedRAMP.gov. The official website outlines the program's structure and defines the security baselines as Low

Moderate

and High

confirming that "FedRAMP Secure" is not a valid designation. (Accessed via https://www.fedramp.gov/about-us/)