What is a cross domain solution?

A cross domain solution (CDS) is a form of controlled interface that provides the ability to manually and/or automatically access and transfer information between different security domains. A CDS may consist of one or more devices. That is the definition in the 2022 Committee on National Security Systems glossary (CNSSI 4009-2022), shown in the National Institute of Standards and Technology (NIST) glossary. The National Security Agency (NSA) describes its National Cross Domain Strategy & Management Office (NCDSMO) as the focal point for U.S. Government cross domain capabilities, under Executive Order 12333 and National Security Directive 42.

What a security domain is

The definition turns on the phrase security domain. CNSSI 4009-2022, through the NIST glossary, defines it as a domain operating at a single security level, which includes a unique combination of classification, releasabilities, and dissemination controls. The domain implements a security policy and is administered by a single authority. By that definition, two networks at the same classification are different domains when their releasability or dissemination controls differ.

The NSA page words it slightly differently: cross domain solutions are controlled interfaces that let users manually or automatically access or transfer information between security domains. The glossary's "and/or" covers solutions that do both.

The Department of Defense (DoD) adds a placement rule. All CDSs are deployed and managed on the controlling domain of the interconnection, defined as the domain that assumes the greater risk and thus enforces the most restrictive policy.

Transfer, access, and multilevel solutions

The glossary and the DoD instruction define three kinds.

• Transfer. A transfer CDS enforces security policy for the movement of data between information systems operating in different security domains.
• Access. An access CDS provides access to a computing platform, application, or data in different security domains without transfer of user data between them. The entry notes that keyboard and mouse data go down to the lower domain and video or image data come up to the higher one.
• Multilevel. DoD defines a multi-level solution as a technical implementation of multilevel security: processing information of different classifications and categories while permitting access by users with different clearances and denying users who lack authorization.

The glossary calls the access type a type of transfer CDS. The DoD instruction defines it as access from a single device without any transfer between domains. The instruction's passage on the baseline list names all three: access, data transfer, and multi-level solutions.

The baseline list

DoD Instruction (DoDI) 8540.01, Cross Domain (CD) Policy, dated May 8, 2015 and incorporating Change 1 of August 28, 2017, sets the order of choice. Enterprise cross domain services come first when they meet the mission. Otherwise, a requirement must be met by a CDS on the baseline list managed by the Unified Cross Domain Services Management Office (UCDSMO), the name the instruction uses. If no listed solution fits, a modified listed solution or new technology may be used after an analysis of alternatives.

Each listed solution has passed a security control assessment in a non-operational environment against published test standards. The authorizing official (AO) then directs an onsite assessment before use at a site. A sunset list holds solutions that are end of life, superseded, or no longer meet a needed capability, and they must be replaced within an agreed period. Running a CDS that is not on the baseline list requires a letter of exception.

The instruction gives an Intelink address for the list, and the NSA page lists Intelink-U, Intelink-S, and Intelink-TS sites for the office's standards library. Neither page publishes the list.

Raise the Bar

The NSA page describes Raise the Bar as a strategy for improving CDS security and capabilities from a design, development, assessment, implementation, and use perspective. NSA says it is intended to apply to all CDSs used to protect U.S. Government classified information and all CDSs sold for export, and to improve the community's ability to address emerging threats while meeting mission requirements and keeping life-cycle costs affordable.

The page lists the office's work: oversee cross domain activities across the government, maintain the security requirements for CDSs used by the U.S. Government and the Foreign Military Sales Program, oversee the Cross Domain Solutions Testing Program, and run a Cross Domain Threat Intelligence Activity.

For commercial cloud, the Defense Information Systems Agency (DISA) Cloud Service Provider Security Requirements Guide, Version 1, Release 7 of June 30, 2026, says all CDSs shall meet the latest Raise the Bar Cross Domain Solution Design and Implementation Requirements document, NCDSMO-R-00008-005_00.

Why moving files between networks is controlled

Under DoDI 8540.01, information flow between domains is authorized to meet essential mission requirements, based on an assessment of the need, security compliance, and risks. The DoD risk executive weighs the need against the risk to all affected systems and makes the decision, called a CDS authorization.

The instruction then controls what crosses:

• Information transferred between domains must be correctly marked, protected, and disseminated under DoD Manual 5200.01.
• Where the limits of a specific CDS require it, a reliable human review applies: a person with knowledge of the subject checks data intended for transfer from high to low against the security policy.
• A CDS found operating without approval, or outside its approved configuration, requires immediate chain of command notification to decide whether to disconnect it.
• The Component AO approves removable media for cross domain transfers, and any alternate approver must be an O-6 or equivalent. Only designated personnel do the transfers, and the media is accounted for and marked.

What to check

• Is the solution a transfer, access, or multilevel CDS, and which domains does it join?
• Is it on the baseline list, on the sunset list, or running under a letter of exception?
• Does it meet the Raise the Bar requirements DISA cites, NCDSMO-R-00008-005_00?
• Who granted the CDS authorization, and was the onsite assessment done?
• For high-to-low transfers, does reliable human review apply, and are transferred files marked under DoD Manual 5200.01?
• If removable media carries data between domains, did the AO approve it?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1cross domain solution (glossary entry) · National Institute of Standards and Technology, from CNSSI 4009-2022
2. 2security domain (glossary entry) · National Institute of Standards and Technology, from CNSSI 4009-2022
3. 3transfer cross domain solution (glossary entry) · National Institute of Standards and Technology, from CNSSI 4009-2022
4. 4access cross domain solution (glossary entry) · National Institute of Standards and Technology, from CNSSI 4009-2022
5. 5multilevel security (glossary entry) · National Institute of Standards and Technology, from NIST SP 800-53 Rev. 5 and CNSSI 4009-2022
6. 6National Cross Domain Strategy & Management Office · National Security Agency (page archived September 30, 2026)
7. 7DoD Instruction 8540.01, Cross Domain (CD) Policy, May 8, 2015, Incorporating Change 1, August 28, 2017 · DoD Chief Information Officer (Directives Division copy, archived June 16, 2026)
8. 8Cloud Service Provider (CSP) Security Requirements Guide (SRG), Version 1, Release 7 · Defense Information Systems Agency, 30 June 2026, zip download

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.