Journey · two seats · IL5
You support a JWCC IL5 landing zone — or you consume it. Hosted is AWS or Azure. On-site is Google Distributed Cloud in the building, with first production at month 24. The mission does not land in a blessed tenancy until that path is IATT or ATO. Preparing does not wait. IATO is gone. This kit does not occupy IL6.
Two seats
Cloud Foundation Team. Common control provider. You vend, bound, and operate the IL5 tenancy other missions inherit.
Org, Control Tower, SCPs, hub, 10 Gig / 100 Gig pipe, SCCA as placed, IAM IC as RP, account vending, org trail, 03:00 of the platform.
You do not own the mission app. You do not sign its 03:00. You do not authorize a workload by blessing the LZ.
Mission owner of this C-ITP. You occupy a slice of the blessed LZ. Your application is iterative and resilient — not 100% inherited cloud-native.
The app, data, keys, hybrid path, COTS, lifted tiers, file, PAM, Thunderdome catalog entries, 03:00 of this system, fail back to on-prem.
You do not land testers or production in GovCloud until the LZ letter names the tenancy. You do not wait to categorize, select, or design dual-run.
The hold
The road
AO · IL from the data · CUI vs NSS · C-ITP name · Fork: combined vs CCP
Stand up the CFT analogue. Name the IL5 partition. Name JWCC as the vehicle. Name combined-first vs LZ-as-CCP. Write the four inherit columns as if they will split.
Name this C-ITP the same as the UII. Categorize. List the eight services the slice will call. Sketch dual-run and fail back. Do not wait to start the package.
Nobody occupies GovCloud. Naming is work.
JWCC TO · AWS GovCloud · DAPPS / HaCC · PA in DCAS · One prime
Compete and award AWS. CLIN live this fiscal year. Confirm the CSO PA at IL5 — GovCloud, not commercial. Marketplace listing is not a PA.
Feed the PWS with the eight services and the IL. You cannot pay the IL without the CLIN. You can still write residual.
No mission landing without a bill. Preparation does not need the CLIN in hand.
10 Gig floor · 100 Gig likely · Direct Connect · BCAP · Dual-home
Order the interconnect. 10 Gig dedicated is the floor. 100 Gig is the likely production pipe. Dual-home before ATO. Not a JWCC CLIN.
Size S2S, replication, and file from the data plane — not from user HTTPS. Thunderdome will take people. This pipe still carries systems.
Skinny hosted DX is not occupancy of a 500–2000 server estate. Mission landing waits on a named pipe. Sizing it does not.
CreateGovCloudAccount · BYO Audit + Log Archive · Test OU ≠ prod · SCPs · IAM IC
Independent GovCloud org. BYO Audit and Log Archive. Test OU open. Prod SCP-locked empty. Hub VPC. No 0.0.0.0/0 user ingress.
You cannot receive a workload account until the CFT vends it into the Test OU. Keep drafting the slice SSP. Do not invent a second org.
Account Factory cannot create in GovCloud. Mission landing waits on a vended account in the test OU.
BCAP · VDSS · VDMS · TCCM · SAML to ICAM · ZTNA connector
Place SCCA four functions. Federate IAM IC to ICAM (ACS signin.amazonaws-us-gov.com/saml). Connector subnet in the hub/mission pattern. TCCM is a person.
Map ICAM groups to app roles. Draft the Thunderdome catalog for this slice. Identity-trust is the assertion — path-trust is SNAT. Connector in your VPC waits on vend.
People do not arrive until a connector sits in an IL VPC. Catalog drafts do not wait.
IATT letter · Test OU · Named CFT testers · Same arrival path · CPTC ≤90 days
AO signs a bounded test of the platform. Testers occupy the test OU the way production will. Watch org trail and VDMS. IATT is not a parking lot.
You may be named as observers. You do not land the mission app until the letter names the tenancy — or the combined letter includes this C-ITP. Keep dual-run alive on-prem.
Landing the mission in IL5 GovCloud waits on this letter (or a combined first occupancy that names both). Preparing the slice package does not.
Platform ATO · Common controls · Inherit in writing · Prod OU still empty · IATO is gone
AO accepts LZ common controls. Next occupancy can inherit only what this letter named. Combined first occupancy is honest for slice one — write columns as if they will split.
Production users do not enter. Testers enter only if the letter includes this C-ITP. Finish residual verbs. Name fail back. Do not cut on-prem.
An approved JWCC AWS IL5 landing zone is this letter. Mission production waits. Mission IATT may ride a combined letter — name the fork.
One app · One protocol · Synthetic data · Connector in this VPC · Dual-run
Vend the slice account. Watch the org trail. Do not own the app 03:00. Do not flatten this VPC into another mission.
Now you land — testers only, test OU, same Thunderdome path production will use. Dual-run with on-prem. Fail back is a design. COTS and lifted tiers stay residual.
This is the first moment the mission consumer occupies IL5 GovCloud. Not before.
Production users · Live CUI if categorized · Rollback tested · 03:00 of this system · cATO later
Unlock prod OU for this account only when the AO signed. Hub and pipe stay yours. Other missions still sit in other VPCs.
Production users arrive via Thunderdome. S2S still DX/BCAP. On-prem shrinks only when 03:00 works and fail back was tested. A pipeline on a VM is not a cATO.
Nothing mission-production enters before this letter. IATO is gone.
New C-ITP · New residual · Same hub · Clone IaC · Split CCP
You are now the CCP the second mission expected. Clone the pattern. Do not re-authorize the org for every app.
Next slice prepares while the last one operates. Same rule: landing waits on a letter. Preparing does not. Other missions still do not inherit this ATO.
Waiting for a perfect platform before any mission IATT is how programs stall. Waiting to prepare until the LZ ATO is signed is the same stall in a different chair.
Not this · one tenancy
This journey stops at IL5. Secret is a different realm.
Landing waits. Categorize, residual, dual-run, and the eight services do not.
A blessed platform does not authorize a workload.
Gone. Operate with ATO or IATT.
COTS, file, and lifted tiers remain residual.
How people arrive. Not what they occupy.
Two pathways · 24 months · IL5
One pathway is AWS GovCloud or Azure Government — totally hosted. The other is Google Distributed Cloud on-site, because this mission needs the data and the resiliency inside the fence. Support builds both. The mission consumes both. First production on GDC is month 24 — the long pole is hardware, site, and a different CSO PA. This kit does not occupy IL6.
AWS GovCloud (US) or Azure Government / DoD regions. Pick one as first occupancy.
Elastic IL5. Thunderdome can take people. 10 Gig / 100 Gig DX into the hub. Faster letter.
That prime's JWCC catalog at IL5. PA in DCAS. Not commercial.
Users: Thunderdome SASE → connector in the mission VPC. Systems: DX / BCAP.
CLIN, LZA, SCCA, IATT then ATO. Months, not a loading dock.
GDC Hosted or GDC appliance in IL5 configuration, in this agency's facility. Racks you can walk to.
Data gravity and resiliency inside the fence. Sensitive IL5 / CUI that must not depend on a region staying up. Not a shortcut to Secret.
A different CSO than Assured Workloads in Google Cloud US regions. Check DCAS for the GDC offering at IL5. The hosted Google PA does not cover the rack.
Local ICAM / Keycloak or federated IdP on the IL. Thunderdome SASE is not the path into an on-site rack unless you named a connected mode and a connector. DISN still BCAP if the rack talks out.
Site, power, cooling, order, ship, install, keys, time source, patches, then IATT then ATO. That is why production on GDC sits at month 24.
Split the estate
Workloads the AO will accept in hosted IL5. Burst, analytics, commodity, the slice that can dual-run and fail back.
Data and systems that need the rack: gravity, resiliency, sovereignty the hosted region cannot promise. Still IL5. Still CUI or NSS. Not SIPR.
Two inheritances. Two PAs. Two 03:00 owners — or one person named twice. Reciprocity is not automatic across a region and a rack.
Four experiences
JWCC TO. LZA / Control Tower or Azure LZ. Hub, DX, SCCA, IAM IC as RP, vending, org trail. Platform IATT then ATO. Other missions inherit this LZ.
You do not own the app. Blessing GovCloud or Azure Government does not bless the GDC rack.
Prepare now. Land testers when the hosted IATT names the tenancy. Production on hosted ATO — likely months 12–18. Dual-run with today's on-prem until GDC is live.
This ATO does not land you on GDC. Sensitive-stay data does not ride hosted because the rack is late.
Site survey. Power, cooling, floor, path. Order GDC. Custody of hardware and LUKS/YubiKeys. DoD time source. Appliance firewall. Patch and scan monthly. Local IdP (Keycloak or ICAM). Logs you actually review. Platform IATT then ATO on the rack.
Google does not sit 03:00 in your building. Customer custody is the SRG. You staff the morning after the crate lands.
Prepare the stay-on-site C-ITP in parallel with hosted. You do not load production CUI on the rack until the GDC letter. First production system on GDC is month 24.
Waiting to prepare until the crate is powered is the stall. Landing before IATT is the finding.
A Cloud Foundation Team you already walked: CLIN, LZA, SCCA, Thunderdome as arrival, IATT then ATO. The work is written. The months are shorter.
You land testers once the hosted letter names the tenancy. You can have production on AWS or Azure while the rack is still in customs. That is not permission to put stay-on-site data in the region.
You are running a cloud in a building. Loading dock, cage, keys, time source, monthly scan, log review, Google advisory. Custody is yours. Google's PA is the offering — not your 03:00.
You prepare for two years and occupy late. The first production system on the rack is the date the resiliency story becomes true. Until then, dual-run is the architecture.
24 months
Support. CFT analogue. Pick AWS or Azure as first hosted occupancy — one prime. CLIN, PA list, IL from the data.
Participant. Split the estate: may-leave vs stay-on-site. Categorize two C-ITPs if the AO will split. Dual-run design. Eight services per path.
Support. Site survey. Power, cooling, weight, path from dock to cage. Confirm GDC CSO PA at IL5 in DCAS. Name whether GDC rides JWCC edge or a different buy.
Participant. Name the stay-on-site system of record. Say what will not inherit. Do not wait for the rack to start eMASS.
Nothing production. Two packages started.
Support. Vend the GovCloud or Azure LZ. SCCA placed. ICAM RP. Platform IATT. 10 Gig floor / 100 Gig likely in the hub.
Participant. Slice IATT on hosted if the letter includes this C-ITP. Testers only. On-prem still authoritative.
Support. Order. Ship. Cage ready. Key ceremony planned. DoD time source named. IdP design (Keycloak on-box vs ICAM). Connected vs disconnected named in writing.
Participant. Keep preparing the GDC C-ITP. Do not copy the hosted SSP and call it the rack.
Hosted test occupancy possible. GDC is still a crate or a cage.
Support. Hosted platform ATO — or combined first letter split in the columns. Prod OU for the hosted slice only.
Participant. First hosted production slice. Thunderdome for people. DX for S2S. Fail back to on-prem still works. Sensitive-stay data still not here.
Support. Racks land. Install. LUKS keys in custody, YubiKeys not in the same bag as the crate. Firewall, patches, scan, log review. Local 03:00 named. Platform IATT package.
Participant. Observe install. Still no production CUI on the rack. Map app roles to the local IdP.
Hosted can be live. GDC is not.
Support. Operate. Drift visible. Do not freeze hosted because GDC is late.
Participant. Iterate the next hosted slice if the AO wants. Dual-run still includes today's on-prem for stay-on-site data.
Support. AO signs bounded test of the rack. Testers are CFT and named assessors. Same arrival path production will use on-site — not a second door at ATO.
Participant. Named testers on the GDC slice IATT if the letter includes this C-ITP. Synthetic data unless the AO says live.
GDC is test. Hosted may already be operations.
Support. Still the CCP for hosted. Two platforms now. Do not mash logs into one lie.
Participant. Stay-on-site data cuts only when GDC 03:00 works and fail back was tested. Hosted slice stays for what may leave the fence.
Support. AO signs the GDC platform ATO — or the combined GDC letter. Next on-site occupancy inherits only what this letter named.
Participant. First production system live on Google Distributed Cloud. Month 24. IATO is gone. A pipeline on the rack is not a cATO.
Both pathways can be operations. Two ATOs. Two 03:00s.
Refuse these
DISA PA at IL6 is Secret / SIPR. This kit stops at IL5. On-site here is GDC at IL5 for gravity and resiliency — not a classified shortcut.
Hosted Google IL5 is a software-defined folder in US regions. GDC is a different CSO. Check DCAS twice.
SASE is how people arrive to hosted. On-site GDC is local IdP and a named network. Connected mode is a design you write, not a default.
Hosted can go live in year one. Parking every workload for the long pole is how programs stall.
IATT then ATO. Hardware on the floor is not occupancy.
Two boundaries. Two inheritances. Combined first occupancy is a slice, not a mash-up of AWS and GDC.
JWCC 7 Dec 2022. Cloud SRG. DoDI 8510.01. GDC IL5 appliance configuration (customer custody of hardware, keys, IdP). GDC air-gapped IL6 is Secret — not this journey. IATO is gone.
Sibling papers: Occupy AWS through JWCC · Two ATOs · Hosted + GDC · Buy vs connect is a different on-ramp.
DoDI 8510.01. Cloud SRG. JWCC 7 Dec 2022. DISN CPG Appendix C. McKeown memo 3 Feb 2022. IATO is gone.