Boundary · packets
Users can arrive SASE. Cloud to DISN still goes through the CAP.
Secure Cloud Computing Architecture is the DoD boundary pattern for commercial cloud at IL4 and IL5. Four functions. Not a product SKU. If the path to NIPR is a drawing, occupancy is theater.
Four functions
BCAP. VDSS. VDMS. TCCM is a person.
BCAPProtect DISN from the cloudDirect Connect / TGW to the CAP. Thunderdome may take user-to-cloud. Cloud→DISN and S2S still this path.IATT: Named. Not optional because testers arrive via SASE.
VDSSVirtual security stackNetwork Firewall or GWLB + NGFW, WAF, GuardDuty, private endpoints. Around the test VPC.IATT: In the test VPC before testers land. A drawing is not VDSS.
VDMSHost and posture managementSystems Manager, Config, Inspector, patch, Security Hub, SIEM feed. The 03:00 owner reads this.IATT: ConMon-lite of the test tenancy. Thunderdome logs are not this.
TCCMA person, not a productIAM IC permission sets. No long-lived keys. Break-glass. PAM on the IL.IATT: Named before the AO signs. User ICAM is not standing admin.
Not this
SCCA is how packets are allowed. Thunderdome is how people arrive. They are not substitutes.
- Not A product you buyFour functions you place — or inherit in writing.
- Not ThunderdomeSASE does not replace BCAP for cloud → DISN or site-to-site.
- Not The CSP PAThe offering's authorization is not the boundary stack.
- Not Required at IL2IL2 may use NIPR IAP. IL4/IL5 off-premises commercial CSO → BCAP.
Phase Zero
Place the stack before testers land.
Leave with the sponsor
BCAP named. VDSS/VDMS in the test VPC. TCCM a person. Same arrival path production will use.
A drawing is not VDSS
IATT gate 3: SCCA placed before testers land. A drawing is not VDSS.
SCCA is how packets are allowed. Thunderdome is how people arrive. They are not substitutes.