DoD Impact Levels (IL2-IL6)
DoD impact levels sort cloud-hosted defense information by sensitivity: IL2 for non-controlled unclassified information, IL4 for CUI, IL5 for CUI needing added protection plus unclassified national security systems, and IL6 for classified data up to Secret. The level dictates which authorized cloud services may host the data.
The framework comes from DISA's Cloud Computing Security Requirements Guide under DoD CIO policy, and it currently defines four levels. Mission owners categorize their systems under DoDI 8510.01 and CNSSI 1253, then match that categorization to an impact level: IL2 for non-controlled unclassified information, IL4 for CUI, IL5 for CUI requiring higher protection and unclassified national security systems, IL6 for classified information up to Secret.
A cloud service offering must hold a DoD provisional authorization or a component ATO at the required level before it hosts mission data. IL2 rides the FedRAMP Moderate baseline; IL4 and IL5 layer DoD-specific controls on top under FedRAMP+; IL6 runs on infrastructure cleared for classified processing. DFARS 252.239-7010 makes the SRG contractual, binding the contractor to the version in effect when the solicitation issued.
The recurring failure is provisioning at IL2 because it is fast, then discovering the workload is CUI. DoD's cloud guidance is blunt: never host higher-level data on a lower-level service.
Regulatory Reference
DoD Cloud Computing Security Requirements Guide; DFARS 252.239-7010; DoDI 8510.01; CNSSI 1253
RFO Status
Impact levels live in DoD policy and the DFARS, which the FAR Overhaul does not reach; the nearest touchpoint is proposed FAR Part 40's governmentwide FedRAMP Moderate-equivalence requirement for CUI in the cloud, which parallels the IL framework without displacing it.
Category
Regulations & Policy
How AcqBot Helps
AcqBot maps a requirement's data types to the right impact level before solicitation, flags when a workload described as CUI is headed for an IL2 service, and drafts the DFARS 252.239-7010 cloud language and SRG compliance requirements to match.
Related glossary entries
Class Deviation
A class deviation authorizes an agency to depart from specific FAR or supplement provisions for a category of contract actions rather than a single case — the mechanism agencies are using to implement the Revolutionary FAR Overhaul ahead of formal rulemaking.
Commercial Products and Services (FAR Part 12)
Commercial products and commercial services are items of a type sold, leased, licensed, or offered in the commercial marketplace, defined at FAR 2.101. FAR Part 12 implements the statutory preference for buying them whenever market research shows they can meet the agency's need.
Rule of Two
The rule of two directs a contracting officer to set aside an acquisition for small business when there is a reasonable expectation of receiving offers from at least two responsible small business concerns and making award at fair market prices, per FAR 19.502-2.
Controlled Unclassified Information (CUI)
Controlled Unclassified Information (CUI) is information the government creates or possesses, or that an entity handles on its behalf, that a law, regulation, or governmentwide policy requires safeguarding or dissemination controls for — sensitive but not classified, governed by 32 CFR Part 2002.