Cairn · Impact Level 5
Higher-sensitivity CUI, mission-critical, unclassified NSS. High is the floor.
What it holds
CUI is a marking. IL5 is the rest. NSS is a Categorize call, not a region SKU.
cuiHigher-sensitivity CUICUI that needs more protection than IL4 affords. CUI is a marking. IL5 is the rest.
missionMission-critical informationUnauthorized disclosure could have a serious adverse effect. Crit 1–4 is how badly the mission stops — a different axis.
nssUnclassified NSSNIST SP 800-59 / CNSSI 1253. If the system is NSS, say so in Categorize. The NSS overlay is why FedRAMP High ≠ IL5.
Six gates
All six have to be true on the CSO before DISA awards an IL5 PA. Occupancy still needs an AO.
01High floorFedRAMP High / Class D on the CSO. Moderate cannot serve IL5. High is necessary. It is not sufficient (SRG §5.1.1).
02FedRAMP+ / Table D-1DISA parameters and added/adjusted controls on that High package. Same catalog as 800-53. Different pick.
03LocationUS, US outlying areas, or DoD on-premises. Exclusive US legal jurisdiction. Data at rest does not leave that jurisdiction.
04SeparationSRG §5.2.2.3: physical separation from non-DoD / non-federal tenants (public, state/local). Virtual/logical between DoD and other federal tenants is sufficient. Tenant-to-tenant logical is the minimum.
05PersonnelSRG §5.6.2: CSP personnel with access to IL4 and IL5 data are US citizens, US nationals, or US persons. No foreign persons. AO may elevate investigation. IT-2 / ADP-2 is occupancy practice, not a sticker on the PA.
06PathOff-premises IL5 arrives on NIPR via a Cloud Access Point (BCAP / SCCA) or an inheritable access plane (Thunderdome). Direct internet rest is not IL5.
Separation · SRG §5.2.2.3
Physical from non-federal. Logical between federal tenants. Do not park IL5 in an IL4 CSO.
nonfedNon-federal tenantsPhysical. Commercial, public, state, and local cannot share the IL5 CSO's underlying hardware.
fedOther federal tenantsVirtual / logical is sufficient. DoD and civilian federal may share the federal community.
missionMission to missionLogical isolation between tenant systems is the minimum. Your VPC is not their VPC.
il4csoIL5 inside an IL4 CSOJune 2024 SRG no longer documents isolated IL5 compute/storage in an IL4-authorized CSO as acceptable. Buy the IL5 CSO.
How the four primes meet it
The PA is service-by-service. The partition is not the IL.
awsAWS GovCloud (US)Physical government community, independent org from commercial. Confirm the CSO on the IL5 PA — service availability is not the commercial catalog.
azureAzure GovernmentUS DoD regions are exclusive DoD — no extra isolation config. US Gov AZ/TX/VA hold an IL5 PA but some services need Dedicated Host / isolation guidelines. Review the service, not the region slogan.
googleGoogle Assured WorkloadsDISA IL5 PA (2022) on a software-defined community cloud — not a GovCloud physical partition. Occupancy is Data Boundary + Enhanced/Premium US-person support + the PA service list. CMEK is residual.
oracleOracle US Government / DefenseDefense realm is the IL5 occupancy, not commercial OCI. Confirm tenancy, realm, and the PA service list before first occupancy.
Not this
highNot FedRAMP HighHigh is the floor. Extra considerations still have to be assessed before a DoD IL5 PA (SRG §5.1.1).
paNot the PAA DISA IL5 PA says the offering may host. It does not authorize your system. Service-by-service.
govcloudNot the partitionGovCloud / Azure Gov / Assured / Defense realm is where IL5 usually lives. Occupying the partition is not inheriting the IL.
nssNot automatic NSSIL5 can host unclassified NSS. If it is NSS, CNSSI 1253 overlays apply. If it is not, do not import them as theater.
il6Not IL6SECRET / SIPR. Out of this kit.
cmmcNot CMMC / 800-171DIB contractor paths. DoD information systems at IL5 ride 800-53 plus the SRG.
Still yours
The PA is the offering. Residual is the mission. First occupancy is IATT.
- categorizeCategorize
- inheritInherit in writing
- sccaSCCA four functions
- atoIATT then ATO
categorizeCategorizeName CUI vs NSS vs mission-critical. That pick is the AO's, not the CSP's.
inheritInherit in writingCSP PA · access plane · mission residual. Reciprocity is not automatic.
sccaSCCA four functionsBCAP, VDSS, VDMS, TCCM still sit in the LZ unless Thunderdome (or a peer) actually inherits the access plane.
atoIATT then ATOFirst occupancy is bounded test. Production CUI and standing users need an ATO.
FedRAMP High plus FedRAMP+ is how a CSO is assessed toward an IL5 PA. Extra considerations still have to be true before DISA awards it. The AO still authorizes the mission.