Defense · DoW IL5 / IL6

DoW IL5 / IL6 for defense AI workflows

DoW IL5 / IL6 in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Start free Open the Console

Legal forceBinding on DoD components; applies to cloud providers through DISA authorization and contracts

SectorDefense

Checked21 Oct 2026

01 / The rule

What DoW IL5 / IL6 requires

Cloud service providers hosting higher-sensitivity DoD data, and DoD mission owners using them.

01IL5: implement FedRAMP High controls, DISA parameters and SRG FedRAMP+ controls, plus NSS controls where applicable.
02IL5: separate DoD/federal tenants from non-federal tenants and restrict CSP personnel per the SRG.
03IL4/IL5: route traffic through a DoD-approved Boundary Cloud Access Point, not directly to the internet.
04IL6: apply the CNSSI 1253 Classified Information Overlay on dedicated infrastructure that processes classified data.
05IL6: use cleared personnel and classified network connectivity (SIPRNet).
06Obtain a DISA Provisional Authorization and a mission owner ATO; maintain continuous monitoring.

02 / In this sector

In a defense AI workflow

Applies to AI systems as to any system: AI services processing NSS or mission-critical CUI need IL5, and AI on classified data needs IL6 or an accredited classified environment.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

01DoD Provisional Authorization at IL5 or IL6
02Tenant separation and personnel screening documentation
03BCAP or SIPRNet connection approval
04Continuous monitoring and annual assessment reports

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES