Appendix B — Requirements Mapping and Sources

A compliance-enabling crosswalk, not a compliance claim: each federal requirement that touches DNS, DHCP and IPAM (OMB M-22-09, M-21-31, M-08-23 and M-21-07, CISA Protective DNS and BOD 18-01, TIC 3.0, NIST SP 800-81 Rev. 3, SP 800-53 Rev. 5 and FedRAMP), what it actually asks, where the book addresses it and the evidence it calls for, followed by every source the book cites.

Appendix B — Requirements Mapping and Sources

A mapping is only useful if it says what each source actually requires, and no more.

NoteIn this appendix

What each federal requirement that touches the name layer asks of DNS, DHCP and IPAM, in its own words where the wording matters; the chapter that addresses it and the evidence an assessor can expect; notes on reading the SP 800-53 controls; and the full source list, with primary sources separated from third-party ones.

ImportantCompliance-enabling, not a compliance claim

This appendix helps an agency reuse the book’s design and evidence in its own system security plan. It doesn’t claim that following the book satisfies any requirement or control. The agency’s DNS, DHCP and IPAM services are part of the agency’s own systems; the agency authorizes them, and any cloud service they depend on needs its own FedRAMP certification (Chapter 03). Control selection, implementation statements and assessment belong to the agency and its assessors. Requirement wording is summarized; the cited documents govern. Every source was checked on October 20, 2026.

Requirements mapping

Requirement (source) What it asks of DNS, DHCP and IPAM Addressed in Evidence
Encrypted DNS (OMB M-22-09) “Agencies must resolve DNS queries using encrypted DNS wherever it is technically supported.” Agency resolvers must support DNS over HTTPS or DNS over TLS and use them upstream; endpoints must enable encrypted DNS in applications and the operating system where available and be explicitly configured to use agency-designated resolvers; gaps go in the zero trust plan, with enterprise-wide support by FY 20241 Ch 03, Ch 05 Resolver DoT and DoH configuration (DoQ where supported); endpoint DNS policy; rules that block port 853 and public DoH resolvers
Protective DNS for egress (OMB M-22-09; CISA Encrypted DNS Implementation Guidance; CISA Protective DNS) Agencies “are already required to have DNS requests routed through CISA-operated infrastructure,” and M-22-09 directed CISA’s Protective DNS to support encrypted DNS and scale to cloud and mobile use.2 The CISA service is a recursive resolver upstream of agency networks that blocks, redirects or sinkholes queries matching threat indicators and alerts the agency; it doesn’t interfere with internal DNS34 Ch 03, Ch 05, Ch 08 Forwarding-chain configuration; redirect-dns targets; resolver logs showing the governed path
DNS logging (OMB M-21-31) Passive DNS is an EL1 (Basic) requirement, due within one year of the memo: agencies “shall implement a Domain Name System (DNS) logging system,” including requests made over encrypted DNS, with analytics that identify the host that sourced each query; DNS query and response logs are among the required log categories5 Ch 03, Ch 11 Query-log configuration, SIEM ingestion, retention settings, source-host attribution
DNSSEC (OMB M-08-23; SP 800-53 SC-20 and SC-21) M-08-23 required DNSSEC deployment to all applicable federal systems and all agency .gov domains signed by December 2009.6 SC-20 requires authoritative services to return origin-authentication and integrity artifacts and to support a chain of trust with child zones; SC-21 requires resolvers to request and perform that verification on the answers they receive7 Ch 03, Ch 06 Signed-zone inventory, DS publication, KSK and ZSK rollover records, resolver validation settings
Name and address resolution architecture (SP 800-53 SC-22) The systems that collectively provide name and address resolution must be “fault-tolerant and implement internal and external role separation”8 Ch 03, Ch 08 Architecture diagram, resolver redundancy, internal and external role separation
TIC 3.0 DNS policy enforcement point (CISA TIC 3.0 Security Capabilities Catalog) Five DNS PEP capabilities: domain name sinkholing; DNSSEC validation of agency clients’ lookups for internal and external domains; DNSSEC signing of all agency domains; monitoring for creation of or changes to agency domains; and CISA’s Protective DNS Service. A Web PEP capability, domain resolution filtering, prevents use of unauthorized resolvers over DoH9 Ch 03, Ch 05, Ch 06, Ch 11 RPZ and Protective DNS configuration, validation and signing evidence, domain-monitoring alerts, DoH blocking rules
IPv6 (OMB M-21-07) At least 20% of IP-enabled federal assets IPv6-only by the end of FY 2023, 50% by the end of FY 2024 and 80% by the end of FY 202510 Ch 07 Dual-stack and IPv6-only address plans, DHCPv6 and router advertisement governance, AAAA coverage
Email authentication (CISA BOD 18-01) Valid SPF on all second-level domains; DMARC on all second-level domains, at p=reject on all second-level domains and mail-sending hosts by October 16, 2018, with CISA as an aggregate-report recipient11 Appendix A DMARC, SPF and DKIM records per domain; aggregate report review
Asset inventory (SP 800-53 CM-8; CISA Zero Trust Maturity Model) An inventory of system components that accurately reflects the system, includes all components and is reviewed and updated1213 Ch 01, Ch 07, Ch 11 IPAM discovery reports, CMDB reconciliation results
Audit, change and access control (SP 800-53 AU-2, AU-6, AU-12, CM-3, AC-2, AC-3, AC-6) Logged, reviewed, change-controlled, role-based and least-privilege administration of DNS, DHCP and IPAM14 Ch 03, Ch 09, Ch 11, Appendix A Change logs and approvals, role and scope assignments, review records
Secure DNS deployment (NIST SP 800-81 Rev. 3) Guidance, not a mandate: employ protective DNS wherever feasible; encrypt internal and external DNS traffic wherever feasible; deploy DNSSEC; use dedicated DNS servers. It describes an organization’s DNS service as “both an information source for policy decision points or policy creation and a policy enforcement point”15 Ch 03 – Ch 11 The evidence checklist in Chapter 11
Cloud service certification (FedRAMP) Any cloud-delivered management plane needs FedRAMP certification at the right level, and the agency authorizes its own system that uses it; an agency “should never create a standalone authorization to operate for a cloud service offering”16 Ch 03, Ch 12, Appendix C FedRAMP Marketplace listing, the agency’s ATO for its own DDI system, boundary diagram

Reading the SP 800-53 controls

  • SC-20 and SC-21 split the work by role. SC-20 applies to the authoritative side: return signatures with answers to external queries and indicate the security status of child zones.17 Its enhancement SC-20(2) extends data-origin and integrity protection to internal resolution queries.18 SC-21 applies to recursive and caching resolvers: request and perform validation.19 An estate that signs its zones but doesn’t validate on its resolvers meets only half of the pair.
  • SC-22 is the architecture control. It asks for fault tolerance and internal and external role separation across the systems that “collectively provide” resolution, which is the property the single policy plane in Chapter 08 is designed to make demonstrable.20
  • Baseline membership. SC-20, SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6 are all in the SP 800-53B Moderate baseline; SC-20(2) is not.21 FedRAMP baselines are built on these.
  • Release. Identifiers are from SP 800-53 Rev. 5, release 5.2.0.22

Sources

Every URL below was opened on October 20, 2026. Primary sources (federal documents, standards and the cloud and platform providers’ own documentation of their services) are listed separately from third-party sources, which the chapters label as such in their footnotes.

Primary sources: federal requirements and guidance

Primary sources: IETF, IANA and CA/Browser Forum standards

Appendix A cites the remaining record-type RFCs individually.

Primary sources: cloud and platform provider documentation

Third-party sources

Used only for product-specific facts that no primary source documents. They are labeled “Third-party source” in each footnote.

TipContinue the book

← Previous: Appendix A — DNS Record Types and Ecosystem Integrations · Book index · Next: Appendix C — Applicability →

  1. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, §III.C (Networks), action 1, and “Encrypting DNS traffic,” https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 20, 2026).↩︎

  2. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, §III.C (Networks), action 1, and “Encrypting DNS traffic,” https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 20, 2026).↩︎

  3. Cybersecurity and Infrastructure Security Agency, “Protective Domain Name System (DNS) Resolver,” https://www.cisa.gov/resources-tools/services/protective-domain-name-system-dns-resolver (accessed Oct 20, 2026).↩︎

  4. Cybersecurity and Infrastructure Security Agency, Encrypted DNS Implementation Guidance, May 16, 2024, https://www.cisa.gov/resources-tools/resources/encrypted-dns-implementation-guidance (accessed Oct 20, 2026).↩︎

  5. Office of Management and Budget, M-21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents, August 27, 2021, §II (reach EL1 within one year), Table 2 (EL1 Basic Requirements, “Passive DNS”) and Appendix C (logging requirements), https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf (accessed Oct 20, 2026).↩︎

  6. Office of Management and Budget, M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008, https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2008/m08-23.pdf (accessed Oct 20, 2026).↩︎

  7. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  8. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  9. Cybersecurity and Infrastructure Security Agency, Trusted Internet Connections 3.0, TIC Core Guidance Volume 3: Security Capabilities Catalog, Version 3.3, September 2026, Table 9 (Domain Name System PEP Security Capabilities, 3.PEP.DO.DNSIN, DNVAC, DNVAD, DNMON and PDSER) and Web PEP capability 3.PEP.WE.DRESF, https://www.cisa.gov/sites/default/files/2026-09/TIC_3.0_Security_Capabilities_Catalogs_September_2026_17.pdf (accessed Oct 20, 2026).↩︎

  10. Office of Management and Budget, M-21-07, Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020, https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf (accessed Oct 20, 2026).↩︎

  11. Cybersecurity and Infrastructure Security Agency, Binding Operational Directive 18-01, Enhance Email and Web Security, October 16, 2017, https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security (accessed Oct 20, 2026).↩︎

  12. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  13. Cybersecurity and Infrastructure Security Agency, Zero Trust Maturity Model, Version 2.0, April 2023, https://www.cisa.gov/zero-trust-maturity-model (accessed Oct 20, 2026).↩︎

  14. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  15. NIST, SP 800-81 Rev. 3, Secure Domain Name System (DNS) Deployment Guide, March 19, 2026, Executive Summary and §1.2, https://csrc.nist.gov/pubs/sp/800/81/r3/final (accessed Oct 20, 2026).↩︎

  16. FedRAMP, “Using a FedRAMP Certified Cloud Service,” FedRAMP Consolidated Rules for 2026, https://www.fedramp.gov/2026/agencies/use/ (accessed Oct 20, 2026).↩︎

  17. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  18. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  19. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  20. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

  21. NIST, SP 800-53B, Control Baselines for Information Systems and Organizations; membership checked against NIST’s OSCAL Rev. 5 Moderate baseline profile, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (accessed Oct 20, 2026).↩︎

  22. NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (release 5.2.0), SC-20, SC-20(2), SC-21, SC-22, CM-3, CM-8, AU-2, AU-6, AU-12, AC-2, AC-3 and AC-6, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 20, 2026).↩︎

Back to top