Open the Console Prepare evidence for program review

Is FedRAMP High enough for DoD, or do I also need an Impact Level?

Generally both: FedRAMP High covers the commercial cloud-security baseline, but DoD layers its own Impact Levels (IL2/IL4/IL5/IL6) under the Cloud Computing SRG for the sensitivity of the workload — IL5/IL6 add NSS and classification requirements FedRAMP High…

register 09 · Compliance pins· FedRAMP
01 ·

Answer.

Certification / ATO evidence regime · FedRAMP.

Generally both: FedRAMP High covers the commercial cloud-security baseline, but DoD layers its own Impact Levels (IL2/IL4/IL5/IL6) under the Cloud Computing SRG for the sensitivity of the workload — IL5/IL6 add NSS and classification requirements FedRAMP High alone does not address. So FedRAMP High is often a prerequisite, not a substitute, for the IL you need. Planisphere measures AI behaviour inside whichever boundary applies; it does not assign your Impact Level.

02 ·

The mark behind the answer.

FedRAMP is a certification, ATO, or clearance evidence regime: owners assemble machine-readable security evidence, route…

Federal cloud certification · CR26 package evidence + 20x machine-readable KSIs.

→ Full reference for FedRAMP

03 ·

More on FedRAMP.

Other questions this mark answers.
What is FedRAMP 20x and how does it change the FedRAMP Certification path? How do I produce machine-readable KSI / continuous-monitoring evidence? What's the difference between an agency ATO and FedRAMP Certification?

Try FedRAMP with a free test key.

Start with the free sandbox. Planisphere measures model behaviour and emits a reproducible, sha-pinned record — it does not certify, file, or give legal advice.

Open the Console Prepare evidence for program review FedRAMP reference
API ·

When FedRAMP asks for proof, hand over records — not assurances.

record the duty · seal the receipt · verify offline

Planisphere records each duty event — an output marked, a disclosure shown, a review made — and seals it into a receipt that verifies offline against our published keys. You send hashes, never content. A record is evidence a third party can check; it is not a certification and not a legal determination.

Open the Console Read the Docs Read the capability briefing

See how a record is checked