Compare

DoW IL2 / IL4 vs ATO: how they differ, side by side

How DoW IL2 / IL4 and ATO differ: what each is, who owes it, when it applies and who enforces it.

DoW IL2 / IL4Binding on DoD components; applies to cloud providers through DISA authorization and contracts

ATOBinding on federal agencies; reaches vendors through contracts

Checked21 Oct 2026

01 / Side by side

DoW IL2 / IL4 and ATO, side by side

	DoW IL2 / IL4	ATO
What it is	federal standard	other
Jurisdiction	United States (federal)	United States (federal)
Legal force	Binding on DoD components; applies to cloud providers through DISA authorization and contracts	Binding on federal agencies; reaches vendors through contracts
Status	In force	In force
Who owes it	Commercial cloud service providers seeking a DoD Provisional Authorization, and DoD mission owners hosting DoD data in commercial cloud.	Federal agencies, which must authorize each information system before use; vendors and contractors whose systems process agency data go through the agency's process.
Enforcement	DISA Authorizing Official (PA issuance, conditions, revocation) and DoD component authorizing officials; contract remedies. No fines.	OMB oversight, inspector general audits and annual FISMA reporting to Congress; no civil penalties. Systems without an ATO should not operate.

02 / DoW IL2 / IL4

What DoW IL2 / IL4 requires

Applies to AI systems as to any system: commercial AI services handling DoD CUI need at least an IL4 Provisional Authorization, and IL2 only suits public or non-critical data.

01IL2: hold a FedRAMP Moderate or High authorization for the cloud service offering.
02IL4: implement FedRAMP Moderate controls plus DISA parameters and the SRG's FedRAMP+ controls (Table D-1).
03IL4: connect through a DoD-approved Boundary Cloud Access Point and use DoD PKI authentication.
04Obtain a DoD Provisional Authorization from the DISA Authorizing Official, then the mission owner's ATO.
05Maintain continuous monitoring, including 30/90/180-day vulnerability remediation and annual assessments.

03 / ATO

What ATO requires

Applies to AI systems as to any system: an AI model, AI-enabled application or AI cloud service used by an agency needs an authorization decision covering its data flows, and changes such as new models or data sources can trigger reassessment.

01Designate senior officials (authorizing officials) to formally authorize systems and common controls.
02Complete an initial authorization for each system, based on explicit risk acceptance, before it becomes operational.
03Categorize the system, select and implement NIST SP 800-53 controls, and assess them before authorization.
04Continuously monitor controls and move to ongoing authorization when eligible.
05Reauthorize systems on a time-driven or event-driven basis as risk changes.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES