Artifact 2 · PA vs first occupancy
Do not write 'the CSP is IL5.' List the eight services the first occupancy will call.
A DISA Provisional Authorization is service-by-service, in DCAS, at a named IL. The company is not the offering. The offering is not your mission ATO. First occupancy is a short list you can prove.
How to check
DCAS, then the PA service list, then the partition constraint.
01Name the primeOne. AWS GovCloud, Azure Government, Assured IL5 folder, or Oracle Defense Cloud. Not 'JWCC.'
02Name the CSOThe offering, not the company. GCS is not Filestore. Azure Files is not ANF.
03DCAS / SNAPIs that CSO listed at this IL, current PA. Candidate ≠ authorized.
04Service listOpen the PA's authorized services. First occupancy's eight calls. Green / yellow / redesign.
05Partition constraintGovCloud BYO accounts. Assured folder + CMEK + US-person support. Azure IL5 isolation guidelines. Oracle realm.
06Write the matrixService × in-PA × constraint × first occupancy × which artifact proves it.
Worked example
Assured folder. GCS lifecycle. Shares as protocol. Anonymous.
requiredAssured Workloads IL5First occupancy: yesFolder exists; org policies on.
in IL5 listCloud StorageFirst occupancy: yesLifecycle classes named. CMEK.
in IL5 listFilestore (NFS)First occupancy: if NFSProtocol vs the estate.
in IL5 listGCE + PD (SMB)First occupancy: if Windows sharesCustomer-managed. Residual.
in IL5 listCloud InterconnectFirst occupancy: yesLOA / pairing. Not internet.
in IL5 listCloud KMS / HSMFirst occupancy: yesCMEK in the folder.
verifyNetApp VolumesFirst occupancy: no until listedDo not assume IL5.
n/aThunderdome HTTPFirst occupancy: wrong doorShares are not ZTNA apps.
Not this
The company is not the offering. The offering is not your ATO.
- Not 'The CSP is IL5'Authorization is the offering, the IL, and the service list.
- Not A vendor slideNot an artifact. Reject.
- Not Reciprocity for the applicationA PA is not the mission ATO.
If they share
An architecture with service names is enough to mark the matrix.
ShareArchitecture with service namesWe can mark the matrix. We will not invent the PA.
SharePA letter / DCAS screenshotWe can score in-scope vs out. Still their check.
ShareCSP console with Assured folderPartition constraint is visible. Service list still DCAS.
ShareVendor slide 'IL5'Not an artifact. Reject.
Phase Zero
Eight services. Not a slide that says IL5.
Leave with the sponsor
Eight services the first occupancy will call, marked against the PA list and the partition constraint.
Awareness, not performance
An architecture with service names is enough to mark. A vendor slide that says IL5 is not an artifact.
Make them aware of what is needed. Do not perform it — unless they already hold the artifact.