Skip to content

Commit ea811de

Browse files
konklonekonklone
committed
clarify domains and subdomains
1 parent 85f1501 commit ea811de

2 files changed

Lines changed: 11 additions & 1 deletion

File tree

‎pages/guide.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,16 @@ This approach allows agencies the flexibility to focus only on publicly accessib
6161

6262
## Compliance FAQ
6363

64+
**What does "all Federal agency domains or subdomains" include?**
65+
66+
Domains and subdomains, in the context of M-15-13, refer to hostnames that are publicly accessible via HTTP or HTTPS.
67+
68+
**Domain** refers to hostnames that are directly registerable. Some examples include `gsa.gov`, `whitehouse.gov`, `dodig.mil`, or `fs.fed.us`.
69+
70+
**Subdomain** refers to any hostname that is a child of a registerable domain, and may be of any length. Some examples include `www.gsa.gov`, `planthardiness.ars.usda.gov`, `www.fia.fs.fed.us`, or `www.usar.army.mil`.
71+
72+
Federally operated domains do not all end in `.gov`, `.mil`, or `.fed.us`. Some may end in `.com`, `.org`, `.us`, or other suffixes. Any federally operated domain is covered by M-15-13.
73+
6474
**What about domains that are only used to redirect visitors to other websites?**
6575

6676
These domains must follow all the same requirements and guidelines as domains used to host websites and APIs, including HSTS and preloading.

‎pages/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ In order to promote the efficient and effective deployment of HTTPS, the timefra
7373

7474
This Memorandum requires that Federal agencies deploy HTTPS on their domains using the following guidelines.
7575

76-
* Newly developed websites and services at all Federal agency domains or subdomains must adhere to this policy upon launch.
76+
* Newly developed websites and services at [all Federal agency domains or subdomains](/guide/#compliance-faq) must adhere to this policy upon launch.
7777
* For existing websites and services, agencies should prioritize deployment using a risk-based analysis. Web services that involve an exchange of personally identifiable information (PII), where the content is unambiguously sensitive in nature, or where the content receives a high-level of traffic should receive priority and migrate as soon as possible.
7878
* Agencies must make all existing websites and services <a name="footnote-source-3"></a>accessible through a secure connection [[3]](#footnote-3) (HTTPS-only, with HSTS) by December 31, 2016.
7979
* The use of HTTPS is encouraged on <a name="footnote-source-4"></a>intranets [[4]](#footnote-4), but not explicitly required.

0 commit comments

Comments
 (0)