United States (federal) · federal standard
DoW IL2 / IL4: what it requires, and the records to keep
The SRG defines Impact Levels for DoD data in commercial cloud: IL2 covers publicly releasable and non-critical mission information, and IL4 covers Controlled Unclassified Information. IL2 rests on a FedRAMP Moderate (or High) authorization, while IL4 adds DoD-specific (FedRAMP+) controls, DISA parameters and connection through a DoD Cloud Access Point.
01 / What it requires
What DoW IL2 / IL4 requires
Commercial cloud service providers seeking a DoD Provisional Authorization, and DoD mission owners hosting DoD data in commercial cloud.
- 01IL2: hold a FedRAMP Moderate or High authorization for the cloud service offering.
- 02IL4: implement FedRAMP Moderate controls plus DISA parameters and the SRG's FedRAMP+ controls (Table D-1).
- 03IL4: connect through a DoD-approved Boundary Cloud Access Point and use DoD PKI authentication.
- 04Obtain a DoD Provisional Authorization from the DISA Authorizing Official, then the mission owner's ATO.
- 05Maintain continuous monitoring, including 30/90/180-day vulnerability remediation and annual assessments.
02 / AI work
Where it touches AI work
Applies to AI systems as to any system: commercial AI services handling DoD CUI need at least an IL4 Provisional Authorization, and IL2 only suits public or non-critical data.
03 / Dates
The dates that matter
CSP SRG Version 1, Release 1 issued, aligned to NIST SP 800-53 Rev. 5
DISA publishes DoD Cloud Authorization Process
CSP SRG Version 1, Release 2 dated (per third-party copy)
EO 14347 adds 'Department of War' as secondary name
04 / Enforcement
Who enforces it
DISA Authorizing Official (PA issuance, conditions, revocation) and DoD component authorizing officials; contract remedies. No fines.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01FedRAMP authorization and DoD Provisional Authorization memo
- 02DoD SSP addendum and 3PAO assessment report
- 03Cloud eMASS package and monthly scan reports
- 04Mission owner ATO referencing the PA
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
DISA / DoD Cyber Exchange
Federal Register
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: DoW IL2 / IL4 vs ATO · DoW IL2 / IL4 vs CMMC · DoW IL2 / IL4 vs DFARS 252.204-7012 · DoW IL2 / IL4 for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4