DoD Impact Levels (IL2-IL6)

DoD impact levels sort cloud-hosted defense information by sensitivity: IL2 for non-controlled unclassified information, IL4 for CUI, IL5 for CUI needing added protection plus unclassified national security systems, and IL6 for classified data up to Secret. The level dictates which authorized cloud services may host the data.

The framework comes from DISA's Cloud Computing Security Requirements Guide under DoD CIO policy, and it currently defines four levels. Mission owners categorize their systems under DoDI 8510.01 and CNSSI 1253, then match that categorization to an impact level: IL2 for non-controlled unclassified information, IL4 for CUI, IL5 for CUI requiring higher protection and unclassified national security systems, IL6 for classified information up to Secret.

A cloud service offering must hold a DoD provisional authorization or a component ATO at the required level before it hosts mission data. IL2 rides the FedRAMP Moderate baseline; IL4 and IL5 layer DoD-specific controls on top under FedRAMP+; IL6 runs on infrastructure cleared for classified processing. DFARS 252.239-7010 makes the SRG contractual, binding the contractor to the version in effect when the solicitation issued.

The recurring failure is provisioning at IL2 because it is fast, then discovering the workload is CUI. DoD's cloud guidance is blunt: never host higher-level data on a lower-level service.

Regulatory Reference

DoD Cloud Computing Security Requirements Guide; DFARS 252.239-7010; DoDI 8510.01; CNSSI 1253

RFO Status

Impact levels live in DoD policy and the DFARS, which the FAR Overhaul does not reach; the nearest touchpoint is proposed FAR Part 40's governmentwide FedRAMP Moderate-equivalence requirement for CUI in the cloud, which parallels the IL framework without displacing it.

Category

Regulations & Policy

How AcqBot Helps

AcqBot maps a requirement's data types to the right impact level before solicitation, flags when a workload described as CUI is headed for an IL2 service, and drafts the DFARS 252.239-7010 cloud language and SRG compliance requirements to match.