AWS GovCloud or Azure Government
Pick one as first occupancy. JWCC catalog. PA in DCAS. Thunderdome can take people. 10 Gig / 100 Gig into the hub. Faster letter.
Two pathways
Different CSOs. Different letters. Same IL5.
Google Distributed Cloud in this building
GDC Hosted or GDC appliance in IL5 configuration. Racks you can walk to. Different CSO than Assured Workloads in US regions. Hardware, site, and that PA are why production sits at month 24.
Split the estate
What may leave. What stays. Written twice.
Hosted IL5
Burst, analytics, commodity. Dual-run and fail back. The AO accepts it in the region.
The rack
Gravity, resiliency, sovereignty a region cannot promise. Still IL5. Still CUI or NSS. Not SIPR.
Two inheritances
Two PAs. Two 03:00 owners — or one person named twice. Reciprocity is not automatic.
Four experiences
Support the structure. Participate in it.
CFT for AWS or Azure
CLIN, LZA, SCCA, ICAM RP, IATT then ATO. Blessing the region does not bless the rack.
Mission on the hosted slice
Land testers when the hosted letter names the tenancy. Production possible months 12–18. Stay-on-site data does not ride the region because the rack is late.
CFT for the on-site cloud
Site, power, cooling, crate, LUKS/YubiKeys, DoD time source, monthly scan, local IdP. Google does not sit 03:00 in your building. Customer custody is the SRG.
Mission on the rack
Prepare two years. Occupy late. First production system on GDC is month 24. Dual-run is the architecture until then.
24 months
Hosted can go live in year one. GDC production is month 24.
Name both. Staff both.
Support. Pick AWS or Azure. CLIN, PA, IL from the data.
Participant. Split may-leave vs stay-on-site. Two C-ITPs if the AO splits. Dual-run.
Support. Site survey. Confirm GDC CSO PA at IL5. JWCC edge or a different buy.
Participant. Name the stay-on-site system of record. eMASS can start.
Nothing production. Two packages started.
Hosted IATT. GDC on order.
Support. Vend the LZ. SCCA. ICAM RP. Platform IATT. Pipe in the hub.
Participant. Testers only, if the letter includes this C-ITP.
Support. Order. Cage ready. Key ceremony. Connected vs disconnected named.
Participant. Do not copy the hosted SSP and call it the rack.
Hosted test occupancy possible. GDC is still a crate or a cage.
Hosted production. GDC install.
Support. Platform ATO. Prod OU for the hosted slice.
Participant. First hosted production. Thunderdome for people. Stay-on-site data still not here.
Support. Racks land. Keys in custody — not in the same bag as the crate. Local 03:00. Platform IATT package.
Participant. Observe. Still no production CUI on the rack.
Hosted can be live. GDC is not.
GDC platform IATT
Support. Operate. Do not freeze hosted because GDC is late.
Participant. Next hosted slice if the AO wants. Dual-run still includes today’s on-prem for stay-on-site data.
Support. AO signs bounded test of the rack. Same arrival path production will use on-site.
Participant. Named testers. Synthetic data unless the AO says live.
GDC is test. Hosted may already be operations.
First production on GDC
Support. Two platforms now. Do not mash logs into one lie.
Participant. Stay-on-site data cuts only when GDC 03:00 works and fail back was tested.
Support. AO signs the GDC platform ATO. Next occupancy inherits only what this letter named.
Participant. First production system live on Google Distributed Cloud. Month 24. IATO is gone.
Both pathways can be operations. Two ATOs. Two 03:00s. First production on GDC is month 24.
Not this
The rack is IL5. Secret is a different realm.
DISA PA at IL6 is Secret / SIPR. This kit stops at IL5.
Hosted Google IL5 is a folder in US regions. GDC is a different CSO. Check DCAS twice.
SASE is hosted arrival. On-site GDC is local IdP unless you named connected mode.
Hosted can go live in year one. Parking every workload for the long pole is the stall.
IATT then ATO. Hardware on the floor is not occupancy.
Two boundaries. Combined first occupancy is a slice, not a mash-up of AWS and GDC.