Start from your FedRAMP record
The FedRAMP evidence that IL2 reciprocity and IL4 and IL5 assessments build on, kept current.
Packages →- Home
- DoW Impact Levels
Impact Level evidence, built on FedRAMP
Cloud offerings that serve the Department of War (DoD) are authorized by Impact Level under DISA's Cloud Service Provider Security Requirements Guide, starting from FedRAMP. NISTcompliance.ai keeps the FedRAMP evidence and continuous monitoring that your DISA Authorizing Official and Mission Owners rely on current, in one record.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
What NISTcompliance.ai does
FedRAMP and Impact Level work, together
Continuous monitoring
Evidence your DISA Authorizing Official and Mission Owners rely on after the Provisional Authorization.
Continuous monitoring →Assessor workspace
Evidence and history your assessor can trace, with access you control.
Assessor workspace →Managed remediation
Quzara engineers who work the findings queue with you when the date is close.
Managed remediation →IL2 to IL6
What each Impact Level holds
Swipe to see every column
| Level | Information | Foundation | Authorization |
|---|---|---|---|
| IL2 | Publicly releasable data or nonpublic unclassified data | FedRAMP Moderate, by DISA reciprocity | FedRAMP authorization, leveraged |
| IL4 | CUI and other mission data; covers Moderate and High categorizations since V1R3 | FedRAMP plus DoD requirements | DoD Provisional Authorization |
| IL5 | Unclassified National Security Systems since CSP SRG V1R3. CUI outside an NSS is normally IL4; an Authorizing Official can still require IL5 | Equivalent to FedRAMP High (CNSSP 32) plus DoD requirements | DoD Provisional Authorization |
| IL6 | Classified National Security Information, SECRET and below | DoD requirements; access over SIPRNet | DoD Provisional Authorization |
Sources: DoD Cybersecurity Reciprocity Playbook, DISA release notes, Jul 2025, DoD Cloud Authorization Process. Sources checked Oct 23, 2026. Not a substitute for the official text.
What changed
CSP SRG V1R3, July 2025
V1R3GUIDANCE
IL5 is now for National Security Systems
Since CSP SRG V1R3 (Jul 2, 2025), IL5 covers unclassified National Security Systems. CUI outside an NSS is normally IL4, at Moderate or High. CUI inside an NSS, or CUI the Authorizing Official decides needs more protection, can still be IL5.
V1R3GUIDANCE
IL4 covers Moderate and High
Updated guidance addresses IL4 for both Moderate and High categorizations.
V1R3GUIDANCE
Personnel and responsibility
Major updates to CSP personnel investigations, plus a required responsibility matrix for the Mission Owner.
V1R3GUIDANCE
Incident notification
A new requirement for incident notifications in section 6.2.2.
Sources: DISA release notes, Jul 2025. Sources checked Oct 23, 2026. Not a substitute for the official text.
Provisional Authorization
Who decides what
Swipe to see every column
| Provisional Authorization (PA) | Authorization to Operate (ATO) | |
|---|---|---|
| Granted by | The DISA Authorizing Official | A DoD Component's Authorizing Official |
| Focus | Cloud offering risk and continuous monitoring | Mission risk |
| Applies to | A specific cloud service offering, not the company | The Mission Owner's system that uses the offering |
| Required for | IL4, IL5 and IL6 | Every DoD system |
Sources: DoD Cloud Authorization Process, DoD CIO Cloud Security Playbook, DoD Cybersecurity Reciprocity Playbook. Sources checked Oct 23, 2026. Not a substitute for the official text.
Rules of the road
How PAs are used
PLAYBOOKMUST
Mission Owners use the PA
DoD Mission Owners must leverage a cloud offering's DoD Provisional Authorization.
PROCESSFACT
FedRAMP first
When possible, DoD leverages a cloud offering's existing FedRAMP authorization.
DCASFACT
Where PAs are listed
DoD Cloud Authorization Services and the DISA Storefront list authorized offerings with DoD PAs.
eMASSFACT
Where the package lives
The security authorization package and inheritance are made available in eMASS.
Sources: DoD CIO Cloud Security Playbook, DoD Cloud Authorization Process, DoD Cybersecurity Reciprocity Playbook. Sources checked Oct 23, 2026. Not a substitute for the official text.
FedRAMP reciprocity
What carries over
IL2FACT
Moderate is enough
DISA issued a reciprocity memo for offerings listed in the FedRAMP Marketplace at a minimum of the Moderate baseline, for IL2 data.
FedRAMP+FACT
Then DoW adds controls
FedRAMP+ leverages the FedRAMP assessment but adds controls and adjusts parameter values for DoW missions.
CNSSP 32FACT
High for NSS
Unclassified National Security Systems require at least the equivalent of the FedRAMP High baseline.
NTC-0004GUIDANCE
Classes, not impact levels
FedRAMP's February 2026 notice NTC-0004 planned for Class C to include the then-current Moderate baseline and Class D the High baseline. The final 2026 Class guidance says there is no direct correlation between Certification Class and impact level.
Sources: DoD Cybersecurity Reciprocity Playbook, DoD CIO Cloud Security Playbook, FedRAMP NTC-0004, FedRAMP Certification Classes. Sources checked Oct 23, 2026. Not a substitute for the official text.
Questions
Common questions
Does IL5 still cover CUI?
Only in some cases. Since DISA's Cloud Service Provider SRG V1R3, released July 2, 2025, IL5 covers unclassified National Security Systems and IL4 addresses CUI at both Moderate and High. CUI inside an NSS, or CUI the Authorizing Official decides needs more protection, can still be IL5.
Is the Cloud Computing SRG still current?
DISA has issued a separate Cloud Service Provider SRG and Mission Owner documents. V1R3 of the CSP SRG was released July 2, 2025. Confirm the latest release on DISA's site before you rely on a section number.
Does the DoW accept FedRAMP 20x?
The DoD reciprocity language we can find refers to the FedRAMP Moderate and High baselines, not to FedRAMP 20x or the 2026 Certification Classes. Confirm with your DoW sponsor how they will treat a 20x Certification.
Book a demo
Plan your Impact Level
We will map your FedRAMP evidence to the level your Mission Owners need.