DoD cloud impact levels, explained

An impact level (IL) is the Department of Defense (DoD) category for the information a commercial cloud service offering may hold, defined by how sensitive the information is and how much harm its loss would cause. The levels are set in the Defense Information Systems Agency (DISA) Cloud Service Provider (CSP) Security Requirements Guide (SRG), whose current release is Version 1, Release 7, dated June 30, 2026. Four levels remain: 2, 4, 5, and 6. The guide, which calls the department the Department of War (DoW), says impact levels are a DoW construct only, and that calling one a Federal Risk and Authorization Management Program (FedRAMP) impact level number is inaccurate.

How a level is chosen and granted

The guide defines each level by two things: the sensitivity of the information, and the potential impact of losing its confidentiality, integrity, or availability. Mission owners categorize their systems under DoD Instruction 8510.01 and Committee on National Security Systems Instruction (CNSSI) 1253, then pick the level that most closely fits.

Approval comes in two steps. First, DISA assesses the cloud service offering (CSO) and grants a DoW provisional authorization (PA) for that offering, not for the company. The DISA authorizing official (AO) approves and revokes PAs, and offerings with one are listed in the DoW Cloud Service Catalog. Second, the mission owner's AO accepts the risk to the mission through an authorization to operate (ATO). For Impact Level 4 and above, each offering must hold a PA to host DoW mission systems.

A DISA memo dated June 21, 2024, included in the June 2026 package, says the SRG has two parts, a mission owner document and a CSP document, and moves the controls to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5.

The four levels

The guide's section 3.7 and Table 3-1 give the levels:

Level	Information	Minimum baseline	Access
IL2	Public, or nonpublic unclassified not designated controlled unclassified information (CUI)	FedRAMP Moderate	Internet
IL4	CUI and other mission data	FedRAMP Moderate or High	DoW users through DoW-approved boundaries
IL5	Unclassified national security systems (NSS) and information	FedRAMP High plus NSS controls	DoW users through DoW-approved boundaries
IL6	Classified up to SECRET	FedRAMP High plus classified overlay	SIPRNet, the SECRET network service, or approved circuits

For IL2, the guide expects a limited adverse effect from disclosure; for IL4, IL5, and IL6, a serious adverse effect. A national security system, as defined in law, involves intelligence, cryptologic activities, command and control of military forces, or weapons, among other uses, or is protected as classified. IL6 offerings must run on dedicated infrastructure and may be provided only by CSPs under contract to the DoW or another federal agency.

The 2025 change to Impact Level 5

The revision history in the same package records that Version 1, Release 2, dated July 2, 2025, changed IL5 to accommodate unclassified NSS and national security information, with CUI no longer part of that level. The same entry says IL4 now addresses both moderate and high categorizations.

The Release 7 text does not fully match. Section 3.7.3 still says IL5 includes CUI and other mission data that may need more protection than IL4, as the information owner, law, or regulation requires, and leaves that call to the AO.

References lag too. DISA's Cloud Connection Process Guide, Version 3 of December 2025, cites the SRG dated September 2025. That guide sends IL4 and IL5 connections through a DISA Boundary Cloud Access Point, IL2 through an Internet Access Point, and IL6 to a separate appendix.

What happened to levels 1 and 3

Version 1, Release 2 of the earlier guide, dated March 18, 2016, explains the gap. The superseded Cloud Security Model defined six levels. The number was cut to four by merging level 1 (public information) into level 2 and level 3 (low impact CUI) into level 4. The numbers were kept to stay consistent with earlier versions, and a higher level can process data from a lower one. Release 2 described IL2 as non-CUI information up to low confidentiality and moderate integrity. Release 7 puts IL2 at moderate confidentiality, integrity, and availability.

The 2016 release also set the assessment baseline for all levels at moderate confidentiality and moderate integrity, including IL5 and IL6, which had been high. The 2024 memo reverses that at the top: IL5 and higher now require a high baseline.

How the levels map to FedRAMP Moderate and High

The guide describes FedRAMP as a federally mandated program for assessing and authorizing cloud services the government uses, and says the DoW draws on FedRAMP packages when assessing an offering for a PA. At IL2, the DoW gives full reciprocity to FedRAMP Moderate and High authorizations, which act as an automatic IL2 PA without a written one. DISA can rescind that by memo. At IL4, assessors use the FedRAMP Moderate or High baseline plus DoW FedRAMP+ controls and CNSSI 1253 overlays. At IL5 and IL6, the starting point is FedRAMP High, plus FedRAMP+ controls, overlays, and NSS controls. The guide states that FedRAMP baselines do not address NSS or classified information.

FedRAMP is changing its own labels. A February 25, 2026 notice said the new labels would be Classes A through D, with no levels or numbers, to avoid confusion with the DoD/DOW impact level system. Class C would include the current Moderate baseline and Class D the current High baseline. The June 2026 SRG still says Moderate and High.

What to check

• At which impact level does the offering hold a DoW PA, and is it in the DoW Cloud Service Catalog?
• For IL2, does the offering hold a FedRAMP Moderate or High authorization?
• Which SRG release does the contract or guide cite? The current CSP SRG is Version 1, Release 7, dated June 30, 2026.
• For CUI that needs more than IL4, or for an unclassified NSS, has the AO chosen the level in light of the 2025 IL5 change?
• Has the mission owner's AO issued an ATO? The PA is only the first of two steps.
• Does a vendor claim a "FedRAMP IL5"? The guide calls that wording inaccurate.

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Sources

1. 1Cloud Service Provider (CSP) Security Requirements Guide (SRG), Version 1, Release 7 · Defense Information Systems Agency, 30 June 2026 (Cloud Computing SRG package, with revision history and release memo), zip download
2. 2Department of Defense Cloud Computing Security Requirements Guide, Version 1, Release 2 · Defense Information Systems Agency, 18 March 2016
3. 3Department of Defense (DoD) Cloud Connection Process Guide, Version 3 · Defense Information Systems Agency, December 2025
4. 4NTC-0004 Initial Outcome from RFC-0020 FedRAMP Authorization Designations · FedRAMP, General Services Administration, February 25, 2026
5. 5national security system (glossary entry) · National Institute of Standards and Technology

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.