Appendix B — Requirements Mapping and Sources

Each federal requirement, where the book addresses it, the evidence it calls for, and every source cited

Appendix B — Requirements Mapping and Sources

Each federal requirement, where the book addresses it, the evidence it calls for, and every source cited.

TipDownload this appendix

next-generation-ddi-appb-bundle.docx: this appendix as a Word document. The whole book is also available.

Requirements Mapping

The table maps each federal requirement that touches the name layer to the chapter that addresses it and the evidence an assessor can expect. It is a working aid, not a substitute for the agency’s own control implementation statements. Requirement wording is summarized; the cited documents govern.

Requirement (source) What it asks of DNS, DHCP and IPAM Addressed in Evidence
Encrypted DNS (OMB M-22-09) Resolve DNS queries using encrypted DNS wherever technically supported Ch 03, Ch 05 Resolver DoT, DoH and DoQ configuration; endpoint DNS policy; port 853 and public-DoH blocking rules
Protective DNS for egress (OMB M-22-09; CISA Encrypted DNS Implementation Guidance; CISA Protective DNS) Route agency DNS egress through CISA-operated Protective DNS, including encrypted DNS Ch 03, Ch 05, Ch 08 Forwarding chain configuration; redirect-dns targets; resolver logs showing the governed path
DNS logging (OMB M-21-31, EL-1) Collect and retain DNS request logs Ch 03, Ch 10 Query log configuration, SIEM ingestion, retention settings
DNSSEC (OMB M-08-23; SP 800-53 SC-20, SC-21) Sign authoritative zones; validate on recursive resolvers Ch 03, Ch 06 Signed-zone inventory, DS publication, KSK/ZSK rollover records, resolver validation settings
Name and address resolution architecture (SP 800-53 SC-22) Fault-tolerant, role-separated resolution services Ch 03, Ch 08 Architecture diagram, resolver redundancy, internal/external role separation
IPv6 (OMB M-21-07) Move IP-enabled assets to IPv6-only (80% by end of FY2025) Ch 07 Dual-stack and IPv6-only address plans, DHCPv6 and RA governance, AAAA coverage
Email authentication (CISA BOD 18-01) DMARC p=reject, SPF and DKIM for federal second-level domains Appendix A DMARC, SPF and DKIM records per domain; aggregate report review
Asset inventory (SP 800-53 CM-8; CISA Zero Trust Maturity Model) Continuous, accurate inventory of networked assets Ch 01, Ch 07, Ch 10 IPAM discovery reports, CMDB reconciliation results
Audit and access control (SP 800-53 AU-2, AU-6, AC-2, AC-3, AC-6) Logged, role-based administration of DNS, DHCP and IPAM Ch 03, Ch 10 Change logs, role and scope assignments, review records
Secure DNS deployment (NIST SP 800-81r3) Protective DNS, encrypted DNS, DNSSEC, hygiene, logging, DNS as a Zero Trust policy enforcement point Ch 03 – Ch 10 The checklist in Chapter 10
Cloud service authorization (FedRAMP) Authorization of any cloud-delivered management plane at the right impact level, plus agency ATO Ch 03, Applicability FedRAMP Marketplace listing, agency ATO letter, boundary diagram

Sources

Every URL below was checked as reachable on October 19, 2026. Primary sources (federal documents, standards and the cloud and platform providers’ own documentation of their services) are listed separately from third-party sources, which the chapters label as such in their footnotes.

Primary sources: federal requirements and guidance

Primary sources: IETF and IANA standards

Primary sources: cloud and platform provider documentation

Third-party sources

Used only for product-specific facts that no primary source documents. They are labeled “Third-party source” in each footnote.

Previous: Appendix A — DNS Record Types and Ecosystem Integrations
Next: Next Generation DDI — book home

Back to top