First test authorization · AO decision

Buying cloud is not permission to test. The AO still has to sign a bounded test.

IATT is the controlled way to try a landing zone without treating it as full operations. Time-boxed, named testers, clear exit. It protects the Authorizing Official while the estate is still being stabilized and cleaned up for cloud speed.

Four floors

CLIN. PA. Landing zone. Then the AO signs test.

Four floors. Only the last is IATT.

vehicleJWCC CLIN
paDISA PA on the CSO
lzaLanding zone
iattIATT

JWCC CLINFloorTask order against the Dec 2022 IDIQ. AWS is a prime, not a landing zone. A bill that can pay GovCloud this fiscal year.

DISA PA on the CSOFloorAWS GovCloud (US) at the IL you named. Check the offering, the IL, the services in scope. A PA is not the mission ATO.

Landing zoneFloorLZA / Control Tower in the gov partition. Accounts, SCPs, org logs, hub network. OEM well-architected — not a snowflake.

IATTAO signsAO signs a bounded test. Time, testers, data, environment, exit. Then occupancy of the test OU — not production.

Achievement gates · then testers occupy

Gate 1 · CFTVehicle + PA
Gate 2 · CFTLZA in gov
Gate 3 · CFTSCCA placed
Gate 4 · AOIATT signed

CFTVehicle + PACLIN live. CSO PA at this IL. GovCloud, not commercial.

CFTLZA in govOrg, SCPs, org-wide logs, hub VPC. Test OU ≠ prod OU.

CFTSCCA placedBCAP path named. VDSS/VDMS in the test VPC. TCCM is a person.

AOIATT signedCategorize + Select done. Test plan. Conditions. Then testers occupy.

Purchase to occupancy

Order. Vend. Bound. Select. Ask. Occupy.

Purchase to occupancy · six hops. Order is the order.

01Order
02Vend
03Bound
04Select
05Ask
06Occupy

01OrderJWCC task order. AWS GovCloud. IL on the PA named.

02VendOrg + LZA. Test OU separate from prod. SCPs on.

03BoundSCCA four functions. Identity as RP to ICAM. No public user path.

04SelectCategorize + Select in eMASS. Inheritance columns written.

05AskIATT request + test plan. Conditions the AO can sign.

06OccupyTesters only. Same arrival path production will use. Watch both planes.

AWS GovCloud · LZA

The IATT lives in the test OU. Not in management.

GovCloud Control Tower · commercial births the accounts. GovCloud enrolls them.

01 · CommercialCreateGovCloudAccount
02 · GovCloudIndependent org
03 · GovCloudBYO Audit + Log Archive
04 · GovCloudEnroll the test account

CommercialCreateGovCloudAccountLog Archive, Audit, and later workload accounts are born in commercial US-East-1. Account Factory cannot create them in GovCloud.

GovCloudIndependent orgGovCloud organizations are not commercial organizations. Invite the new accounts. Accept. One Control Tower landing zone per org.

GovCloudBYO Audit + Log ArchiveControl Tower setup names two existing accounts. It will not vend them. Then OUs: Security, Sandbox/Test, Prod (SCP-locked empty).

GovCloudEnroll the test accountInvite the IATT workload account into the Test OU. SCPs bind. Org trail is already on. This is the tenancy the letter will name.

Not Account Factory createRemoved in GovCloud. Commercial CreateGovCloudAccount, then invite.
Not Resource Control PoliciesRCPs are not available. SCPs carry the deny-public / gov-region floor.
Not AFT for new customersCodeStar Connections is not in GovCloud. Do not plan AFT as the IATT path.
Not Consolidated billing featureNot available in GovCloud Control Tower the commercial way.
Not Export-controlled in CT metadataAccount names, emails, OU names are Control Tower metadata. They cannot hold export-controlled data.
Not One org, both partitionsA commercial org cannot contain GovCloud accounts. Two partitions, two orgs.

AWS GovCloud org · IATT occupies the test OU, not management

mgmtManagementOrgs, billing, IAM IC. SCPs do not bind here. Keep it empty.

logLog archiveOrg CloudTrail, Config, VPC flow. Immutable. Government region.

auditAudit / SecurityGuardDuty, Security Hub, Access Analyzer. Delegated admin.

netNetworkTransit Gateway, shared subnets, endpoints. No 0.0.0.0/0 user ingress.

idIdentityIAM IC delegated. SAML to ICAM. ACS signin.amazonaws-us-gov.com/saml.

testTest OU · IATTThe occupancy. Workload accounts under test. Not prod. Not management.

Six rungs · green means the AO can consider IATT. Not that IATT exists.

Rung 1Tenancy
Rung 2Identity
Rung 3Org trail
Rung 4Network
Rung 5Keys + policy
Rung 6Privileged

Rung 1TenancyGovCloud org. Security OU (Log Archive, Audit). Test OU with the named account. Prod OU exists and is empty / SCP-locked.

Rung 2IdentityIAM Identity Center in GovCloud. SAML to ICAM. ACS signin.amazonaws-us-gov.com/saml. Audience urn:amazon:webservices:govcloud. No IAM users as testers.

Rung 3Org trailOrg CloudTrail → Log Archive, CMK, immutable. Config aggregator + Security Hub + GuardDuty in Audit. 03:00 owner named.

Rung 4NetworkHub VPC, private subnets, VPC endpoints. No IGW on the test workload. Connector subnet if Thunderdome. BCAP still named for cloud→DISN.

Rung 5Keys + policyCustomer-managed KMS in gov. SCPs: gov regions only, federation-only, deny public, deny disable trail. RCPs will not save you here.

Rung 6PrivilegedTCCM is a person. Permission sets. Break-glass. No long-lived keys. User ICAM is not standing admin of the test OU.

Pattern · IL5 storage as a service

Assured folder. GCS lifecycle. Twelve bases. Shares, not apps.

Assured Workloads is the folder. Not Azure. Not the share.

Assured Workloads Data Boundary for IL5 — the folder, org policies, US-person support. Not Azure. Not a share. Google Cloud Storage lifecycle in that folder. Standard for rapid access. Nearline / Coldline / Archive for the rest.

jwccJWCC · GoogleTask order against the Google prime. The CLIN pays Assured. It does not authorize the shares.

paDISA IL5 PASoftware-defined community cloud via Assured Workloads. Not an AWS-style GovCloud physical partition. The AO still accepts that inheritance.

folderIL5 folderData Boundary for IL5. US regions only. CMEK required. No service-account keys. Enhanced or Premium support. US persons on the ticket.

storeGCS + protocolObject store with lifecycle is in the PA. The departmental share protocol (NFS via Filestore, or SMB on GCE+PD in the folder) is named and residual until the PA list says otherwise.

Twelve bases · one service · departmental shares, not apps

01Base LAN
02On-ramp
03SCCA
04Assured VPC
05Share
06Lifecycle

01Base LANDepartmental clients mount a share. They do not open a web app. Thunderdome HTTP catalog is the wrong door.

02On-rampCloud Interconnect (in IL5 scope) or HA VPN on the Interconnect. Twelve sites, one VPC. No public internet as the IL5 path.

03SCCABCAP still protects DISN from the cloud. VDSS around the Assured VPC. TCCM is a person on the folder. Shares do not skip SCCA.

04Assured VPCPrivate. No default network. Restricted API endpoints. CMEK. The folder org policies already refuse the rest.

05ShareNFS (Filestore, file.googleapis.com, in the IL5 control package) or SMB on GCE+PD in the same folder if the estate is Windows. Confirm the protocol against the current PA list before design.

06LifecycleStorage Transfer / GCS lifecycle into Nearline then Archive. Same folder. Same CMEK. Same 03:00 owner.

Twelve bases. One service. Twelve on-ramps. Not twelve ZTNA applications.

Rapid access, then lifecycle. Same folder. Same CMEK. Same IL.

StandardRapidDepartmental working set. Filestore / share protocol in front. GCS Standard behind it if the share is a cache.

NearlineNearAge off the working set. Object class change. Same CMEK. Same folder. Same IL.

Coldline / ArchiveRetainLifecycle backend. Not a second authorization. Retrieval is a process, not a new CSO.

Two inheritances. One residual. The PA does not authorize the twelve bases.

cspCSP PAGCS, Filestore, GCE, PD, KMS, IAM, VPC, Interconnect — in the IL5 list, inside the Assured folder, with Enhanced/Premium support.

assuredAssured folderUS locations, CMEK, no SA keys, skip default network, TLS 1.2+, restrict service usage. Software-defined isolation the AO must still accept.

missionMission residualShare ACLs, base WAN, Interconnect LOAs, SCCA placement, lifecycle policy, key custody, named testers, IATT letter. Twelve bases are twelve on-ramps, not twelve systems.

First IATT

One base. One share family. One lifecycle hop. Synthetic data unless the AO says live. Not twelve bases on day one.

Not this

Not a ZTNA app catalog. Not Azure. Not a second CSO. Not production departmental home drives.

Microsoft prime

Azure Government. Isolation guidelines on top of the tenant. Test management group.

Azure Government (not commercial, not 'the DoD regions' unless that is the named offering).

IL5 isolation guidelines on top of the gov tenant — dedicated hosts where required, CMK, Azure Policy, Private Link. The region name is not the isolation.

jwccJWCC · MicrosoftTask order against the Microsoft prime. The CLIN pays Azure Government. It does not authorize the workload.

paDISA IL5 PAAzure Government CSO at IL5. Check the service list. Commercial Azure is not the path.

lzGov landing zoneCAF / Azure LZ in the gov tenant. Identity, connectivity, management, security subscriptions. Test mgmt group ≠ prod.

idEntra (gov)Gov tenant. Federated to ICAM. App still denies on missing identity even if Thunderdome permitted the path.

01ExpressRoutePrivate circuit to the gov tenant. Not the public internet as the IL5 path.

02BCAPCloud→DISN and S2S still the CAP. Thunderdome may take users. They do not replace ExpressRoute.

03Hub / spokeAzure Firewall / NVA in the hub. Private Link. No default outbound on the test spoke.

04VDMS analogueDefender, Policy, Monitor, Log Analytics in the management subscriptions. 03:00 owner named.

05TCCMPIM on the IL. No standing Global Admin. Break-glass in the gov tenant.

06IATT occupancyTest management group only. Named testers. Synthetic data unless the AO says live.

Management groups: platform (identity, connectivity, management, security) then a test management group. IATT occupies the test group. Prod stays SCP/Policy-locked empty.

Oracle prime

Defense Cloud realm. Compartments are the LZ. FastConnect, not the internet.

Oracle US Government / Defense Cloud. Not commercial OCI. Classified is a different realm.

Dedicated government realms. Compartments are the LZ analogue. The tenancy is not the IATT.

jwccJWCC · OracleTask order against the Oracle prime. The CLIN pays the Defense Cloud. It does not authorize the compartment.

paDISA IL5 PAOracle US Government / Defense Cloud CSO at IL5. Confirm the service list. Commercial OCI is not IL5.

tenancyDoD-realm tenancyCompartment tree. IAM policies. Cloud Guard / Logging in a security compartment. Vault for keys.

idIAM in the realmFederated to ICAM. The app still denies on missing identity even if Thunderdome permitted the path.

01FastConnectPrivate virtual circuit to the Defense Cloud. Not the public internet as the IL5 path.

02BCAPDRG toward the CAP. Thunderdome may take users. Cloud→DISN still BCAP.

03DRG / VCNHub VCN, private subnets, service gateway. No public IPs on the test compartment.

04VDMS analogueCloud Guard, Audit, Logging, Vulnerability Scanning. 03:00 owner named.

05TCCMIAM policies, no long-lived API keys, break-glass. Named person.

06IATT occupancyChild compartment only. Named testers. Synthetic data unless the AO says live.

Tenancy in the DoD realm. Root compartment holds IAM and logging. IATT occupies a child compartment. Prod compartment stays empty and policy-locked.

SCCA in the zone

Four functions. TCCM is a person.

SCCA in the LZ · four functions, not a SKU

BCAPProtect DISN from the cloudDirect Connect / TGW to the CAP. Thunderdome may take user-to-cloud. Cloud→DISN and S2S still this path.Named. Not optional because testers arrive via SASE.

VDSSVirtual security stackNetwork Firewall or GWLB + NGFW, WAF, GuardDuty, private endpoints. Around the test VPC.In the test VPC before testers land. A drawing is not VDSS.

VDMSHost and posture managementSystems Manager, Config, Inspector, patch, Security Hub, SIEM feed. The 03:00 owner reads this.ConMon-lite of the test tenancy. Thunderdome logs are not this.

TCCMA person, not a productIAM IC permission sets. No long-lived keys. Break-glass. PAM on the IL.Named before the AO signs. User ICAM is not standing admin.

Outside DISA

Thunderdome is how testers arrive. The LZ still has to exist.

Outside DISA · the LZ still has to exist

rmfRMF before the request

Named AO, ISSM, SCA.
Categorize: CUI vs NSS, IL from the data.
Select: 800-53B High + Cloud SRG + CNSSI 1253 if NSS.
Inheritance written: CSP PA / SCCA / platform / residual.

lzAWS GovCloud LZ

LZA DoD sample in us-gov-east-1 / us-gov-west-1.
SCPs: government regions, federation-only, deny public user.
Org CloudTrail + Config + GuardDuty on.
CMK in gov. S3 Block Public Access org-wide.

pkgIATT package

DCCS IATT Authorization Request.
Test plan: objectives that need the live environment.
Named testers. Data handling. Duration. Exit to ATO or DATO.
eMASS current. POA&M started. Not a reconstructed binder.

Arrival vs occupancy · Thunderdome is not the test OU

How testers arrive

Testers reach the IATT tenancy the way production will: SASE → connector → test VPC. No second on-ramp at ATO.

What they occupy

The LZ still federates ICAM, places the connector, encodes SCPs, and runs VDSS/VDMS/TCCM. Thunderdome does not occupy the test OU.

What the AO signs

Time. Testers. Data. Environment. Exit.

RMF Authorize · four outcomes. IATO is gone.

TestIATTTemporary. Specified environment. Enumerated conditions. Expires when testing completes. CNSSI 4009.

OperateATOAO accepts residual risk for operations. Production users. Live CUI if categorized.

Operate · constrainedATO with conditionsATO plus named constraints. Still operations. Not a silent IATT extension.

StopDATODenial. Test failed or risk unacceptable. Occupancy ends.

IATO (Interim Authorization to Operate) is not a DoD RMF outcome. DoDI 8510.01 and the DISN Connection Process Guide: operate with ATO or IATT. IATT is test. It is not a mini-ATO.

What the AO actually signs · five conditions

timeDurationExpires when the test objectives complete. Not a rolling ATO.

whoTestersNamed people. Not the enterprise. ICAM-active. No standing access.

dataDataTest data unless the AO explicitly authorizes live. Production CUI is a finding.

envEnvironmentThe test OU. Not prod. Not the management account. Same arrival path production will use.

exitExitObjectives met → ATO package. Objectives fail → DATO or retest. IATT is not a parking lot.

Not IATT

Eight things that get confused with an authorization to test.

Not JWCC purchaseA CLIN is the vehicle. It does not authorize a system.
Not Account vendingGovCloud accounts exist. Occupancy has not started.
Not LZA deployThe platform is ready. The AO has not signed.
Not DISA PAThe CSO may host. This mission may not, yet.
Not ThunderdomeHow testers arrive. Not what they occupy.
Not ProductionIATT is test. Standing users and live CUI need an ATO.
Not Software factorySBOM and OSCAL wait. IATT does not emit a build.
Not cATOAfter an ATO, in Monitor. McKeown memo. IATT is Authorize for test.

DoDI 8510.01: IATT is granted only when an operational environment or live data is required to complete specific test objectives, and expires at the completion of testing.

Open the workbench on this engagement Thunderdome · how testers arrive Back to Cairn