Conduct cybersecurity assessments and validations of Cloud Service Offerings in support of the DoD Provisional Authorization process

Prepare 30 Cloud Security Assessment Packages per year including validated cybersecurity controls and residual risk statements

Review CSP documentation packages including architectural diagrams, SSPs, RARs, SAPs, and SARs

Evaluate supporting materials such as POA&Ms, Change Requests, Extension and Deviation Requests, and Continuous Monitoring artifacts

Attend technical kickoff meetings to evaluate and document CSP security posture and readiness

Analyze and provide feedback on assessment documentation

Identify and document operational impact of security authorizations and vulnerabilities

Develop complete Cloud Security Assessment Packages in accordance with DoD standards

Create authorization recommendation memorandums summarizing compliance and residual risk

Draft DoD PA memorandums outlining CSO boundary definitions and terms

Validate implementation of CSO controls within eMASS or government GRC platforms

Review Customer Responsibility Matrix and ensure correct inheritance mapping

Cloud SCA-R, Mid

Responsibilities