Question · FedRAMP
Is FedRAMP High enough for DoD, or do I also need an Impact Level?
FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO.
01 / The answer
The short answer
Usually not, for DoD data above IL2. DoD applies its Cloud Computing SRG Impact Levels on top of FedRAMP: a FedRAMP authorization can support IL2, but IL4, IL5 and IL6 need a DoD Provisional Authorization from DISA, based on FedRAMP plus DoD-specific requirements such as a Boundary Cloud Access Point connection and DoD PKI for IL4 and IL5. FedRAMP does not cover classified (IL6) data. The DoD mission owner then issues its own ATO.
02 / The rule
What FedRAMP requires
FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO. FedRAMP 20x, now in Phase 3, replaces document-heavy Rev5 reviews with automated, machine-readable validation and Class A to D certifications, and FedRAMP prioritized several generative AI services in 2025-2026.
- 01Cloud providers must obtain FedRAMP certification at the class or impact level matching the agency data.
- 02Implement and evidence the required controls, or the 20x key security indicators, and pass independent assessment.
- 03Perform continuous monitoring and report vulnerabilities and changes to FedRAMP and agencies.
- 04Agencies must reuse existing FedRAMP assessments where practicable and still issue their own ATO.
03 / Records
Records to keep
- 01FedRAMP Marketplace listing and certification letter
- 02System security plan or 20x machine-readable package
- 03Independent assessment report
- 04Monthly continuous monitoring deliverables
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
FedRAMP (GSA)
FedRAMP (GSA)
Legal Information Institute (Cornell)
FedRAMP (GSA)
RELATED
Related: FedRAMP: the full guide · What is FedRAMP 20x and how does it change the FedRAMP Certification path? · How do I produce machine-readable KSI / continuous-monitoring evidence? · What's the difference between an agency ATO and FedRAMP Certification?