The landing zone goes through RMF as a platform. The mission application goes through RMF as a system. They do not sign each other. The app will not be 100% inherited cloud-native. Occupancy iterates. On-prem stays until a slice is proven.
On-ramp · not DITCO vs SNAP
Buy vs connect is a different paper. This on-ramp is what the AO is looking at: a landing zone that other missions can inherit, and a mission application that still owns residual. Inheritance is never 100%.
Org, Control Tower, SCPs, hub VPC, DX/BCAP, org trail, GuardDuty, IAM IC as relying party, SCCA four functions as placed, account vending.
Inherits the CSP PA and the access plane where written. Does not authorize a workload. Does not hold mission data. Does not sign 03:00 for an application.
The app accounts and VPCs. Data. Keys. Share ACLs. Hybrid path to on-prem. Thunderdome catalog entries. 03:00 of this system.
Inherits the eight services it actually calls, LZ common controls in writing, SCCA for data-at-rest, Thunderdome for how people arrive. Residual is verbs — COTS, lifted tiers, file, PAM, fail back.
A DISA PA is neither letter. Thunderdome 152 is neither letter. IATO is gone. Operate with ATO or IATT.
First occupancy is honest
A midsize stand-up often has no Cloud Foundation Team ATO yet. The first C-ITP wraps the landing zone and the first app in one boundary. Name that. Do not pretend a platform ATO exists that nobody signed. Do not make the wrap the pattern for mission two.
Honest for slice one. The next mission cannot inherit a platform that was never named as a platform. Write the four columns as if they will split. Prod OU stays empty until this letter.
The pattern by mission two. Waiting for a perfect platform ATO before any mission IATT is how programs stall. Phase Zero names which fork this occupancy is on.
Cloud SRG · do not collapse
CSP. Access plane. Platform. Mission residual. Reciprocity is not automatic. The AO initials. A 100% inherited cloud-native story has no fourth column — which is how you know it is a slide, not an occupancy.
What DISA already authorized on the offering at this IL. Service list in DCAS. Isolation of the partition. Not your mission. Not your LZ.
BCAP/VDSS/VDMS/TCCM for DISN and data-at-rest. Thunderdome for how people arrive. They do not stack as two user PEPs.
SCPs, org trail, hub, vending, IAM IC, placed SCCA, deny-public. This is the LZ ATO — or the LZ chapter of a combined letter.
The application. Data. Keys. Hybrid. COTS. Lifted tiers. File. PAM. 03:00. Verbs. Not ‘inherited cloud-native.’
| Control | CSP PA | Platform / LZ | Mission residual |
|---|---|---|---|
| PE / isolation | PA on the partition | Gov-region SCPs | AO accepts software-defined vs GovCloud |
| SC / boundary | VPC offering | Hub, TGW, no IGW | Private endpoints. Hybrid DX. This VPC. |
| IA / identity | IAM in partition | IAM IC as RP to ICAM | App roles. Share ACLs. PAM. NPEs. |
| AU / logs | Org trail capability | Log archive + VDMS feed | 03:00 of this C-ITP. App logs. |
| SC / crypto | KMS in PA | CMK policy in gov | CMEK custody. No standing SA keys. |
| CM / config | Org policy | SCP + IaC of the LZ | IaC of the app. Drift of the slice. |
| CP / resilience | Region pair in PA | Dual DX. Two BCAP paths. | Dual-run with on-prem. Fail back. Slice rollback. |
Iterative resilient architecture
A midsize on-prem estate does not arrive as containers, managed data stores, and a factory. It arrives as three-tier, COTS, file, VMs, and a WAN. That is the architecture. Inheritance does not erase it. Occupancy iterates. On-prem stays until a slice is proven.
SCCA placed. ICAM RP. IATT on the platform — or combined with slice 1. On-prem is still the production estate. Nothing has moved.
IATT then ATO on that C-ITP. Thunderdome catalog entry for that app only. Dual-run with on-prem. Fail back is a design, not a panic.
New ATO or a written overlay. Other missions still sit in other VPCs. Do not flatten slice 2 into slice 1 because they share an org.
DX carries S2S and replication. Users arrive via Thunderdome. On-prem shrinks only when a slice has an ATO and a 03:00 that works. A pipeline on a lifted VM is not a cATO.
What the application actually is
Connector on the web tier. Identity in front of the stack — or the app sees only SNAT. LZ gives the VPC, SCPs, logs, hub. Residual is the stack, patch, STIG, app secrets, session.
It expects a service account. It will not become serverless because GovCloud exists. LZ gives the account and the pipe. Residual is the vendor STIG, license, SA, and the hybrid hop.
Not twelve home drives as twelve ZTNA apps. NFS/SMB residual. Object storage is a later slice. LZ gives endpoints and the 10/100 Gig. Residual is ACLs and the on-prem authoritative copy until cut.
Not a rewrite of the system of record on day one. S2S rides DX/BCAP, not Thunderdome. Residual is what is authoritative, what is a copy, and who is 03:00 on both sides.
Sequence
Combined first letter, or LZ as CCP. Write it. Do not discover it in eMASS.
Test OU, hub, pipe, SCCA, ICAM RP. CFT testers. Same path production will use.
One app. Named testers. Synthetic data. Dual-run with on-prem. Connector in that VPC.
AO accepts LZ common controls. Next occupancy can inherit only what this letter named.
AO accepts residual on this C-ITP. Production users. Live CUI if categorized. On-prem stays until cut is a decision.
Next slice. Same LZ. New residual. Fail back still works. cATO only after an ATO on a named DevSecOps design.
Who sits where
| Who | On the LZ letter | On the mission letter |
|---|---|---|
| AO | Signs the platform letter — or the combined first occupancy. | Signs this C-ITP. Residual named. Inherit columns initialed. |
| CFT | Builds and operates the LZ. Common control provider. | Vends the account. Does not own the app 03:00. |
| ISSM / SCA | Assesses platform controls and inheritance from the PA. | Assesses residual, hybrid, COTS, the slice. |
| Mission owner | Consumes common controls. Does not redesign the org. | Owns the C-ITP, the catalog entry, the data, the fail back. |
| TCCM | Standing admin of the LZ. A person. | Privileged path on the IL for this app. Not user ICAM. |
Phase Zero leaves these named
One sentence the sponsor can say.
Verbs in column four. TBD is not a column.
Dual-run. Fail back named.
On-prem system of record. Say it before the vendor slide.
Refuse these collapses
The PA is not the app. The LZ is not the app. Lifted residual is the work.
Combined first occupancy is a slice. It is not the pattern for mission two.
A platform does not authorize a workload. Reciprocity is written.
The next occupancy cannot inherit an SSP that never named common controls.
IATT is test. Dual-run is resilience. Fail back is occupancy.
Buy vs connect is a different on-ramp. This one is two ATOs.
The letter is gone. Operate with ATO or IATT.
cATO is Monitor after ATO, on an approved DevSecOps design.