FedRAMP vs Cloud SRG · what the AO actually needs
FedRAMP High is the floor, not the finish line for DoD.
Civilian clearance and DoD impact levels are different decisions. This page shows the stack so a sponsor can see what still has to be true — and what residual risk stays with the mission — before anyone claims “we are IL5 ready.”
Who authorizes what
FedRAMP clears the offering for civilian use. The SRG lifts that offering toward a DoD PA.
GSA FedRAMPCivilian CSO assuranceAuthorizes a Cloud Service Offering for federal civilian use against FIPS 199 Low / Moderate / High (Classes B / C / D from Jan 2027). Output is a JAB P-ATO or Agency ATO on that offering.Signs. JAB or a civilian agency AONot a DoD impact level. Not a DISA PA. Not your mission ATO.
DISA CC SRGDoD overlay on that floorCategorizes DoD information into IL2 / IL4 / IL5 / IL6. Adds FedRAMP+ (CSP SRG Table D-1), DISA parameters, location, separation, and personnel. Output is a DISA Provisional Authorization at a named IL for a named CSO.Signs. DISA (PA on the offering)Not reciprocity for the application. Not an AO ATO. IL6 is out of this kit.
The stack
Each layer is a different decision. Do not collapse them.
01FedRAMP floorDoD CIO 15 Dec 2014: FedRAMP is the minimum baseline for all DoD cloud. Moderate/Class C or High/Class D on the CSO.
02FedRAMP+ / Table D-1CSP SRG Appendix D. DISA parameters and added/adjusted controls on that FedRAMP package. This is the lift toward a PA — not a second FedRAMP.
03IL overlayLocation, tenant separation, US-person privileged access, NIPR via CAP. IL4 = CUI on non-NSS. IL5 = higher-sensitivity CUI / unclassified NSS. NSS adds CNSSI 1253.
04DISA PAThe offering may host DoD missions at that IL. Service-by-service. 'The CSP is IL5' is not a service authorization.
05SCCA / access planeBCAP, VDSS, VDMS, TCCM — or Thunderdome as the inheritable access-plane occupancy. How people and packets arrive. Not the CSO PA.
06Mission ATOThe AO signs residual controls the PA does not inherit. IATT is test-only. ATO is operate. cATO is Monitor after an ATO.
Reciprocity
IL2 is the only automatic hop. High is the IL5 floor, not IL5.
FedRAMP Moderate→ IL2Yes — DISA memo 15 Aug 2019. Public / non-critical mission information. Reciprocity is designated IL2, not a PA at IL4.
FedRAMP Moderate→ IL4No. IL4 needs FedRAMP Moderate plus Table D-1 FedRAMP+ and DISA parameters. CUI on non-NSS. NIPR via CAP.
FedRAMP High→ IL5No. High is the floor. IL5 still needs FedRAMP+, DISA parameters, dedicated federal-community isolation, US persons on privileged roles, NIPR via CAP. NSS adds CNSSI 1253.
FedRAMP High→ IL4Still not automatic. High can serve IL4's baseline, but Table D-1, US persons, and the CAP path still have to be true on that CSO.
DISA PA at IL5→ Mission ATONo. PA says the offering may host. The AO still authorizes this system, including residual controls.
FedRAMP 20x→ IL5No. 20x is a faster civilian continuous path. It does not replace the Cloud SRG, SCCA, or a DISA PA.
Impact levels
DoD ILs are data sensitivity in the SRG. They are not FedRAMP Low / Moderate / High.
- In kitIL2
- In kitIL4
- CeilingIL5
- OutIL6
IL2Public or non-critical mission informationFloor. FedRAMP Moderate (reciprocity) or HighInternet path. No CUI rest.
IL4CUI on non-NSS (incl. PII/PHI/FOUO)Floor. FedRAMP Moderate + Table D-1, or HighUS persons on privileged access. NIPR via CAP. US or territories.
IL5Higher-sensitivity CUI, mission-critical, unclassified NSSFloor. FedRAMP High + Table D-1 + DISA parametersDedicated federal-community infrastructure, physically separate from non-federal tenants. NIPR via CAP. NSS: CNSSI 1253.
IL6SECRET / classified NSSFloor. FedRAMP High + classified overlaySIPR. Out of this kit.
CSP / Mission Owner
June 2024 split the SRG. The PA is the offering. Residual is yours.
cspCSP SRGWhat the provider must prove on the offering. FedRAMP package + Table D-1 + isolation/personnel. Assessed toward a DISA PA.
moMission Owner SRGWhat you still own: Categorize, residual controls, CAP/SCCA occupancy, testers, data, exit, 03:00. The AO signs this, not DISA's PA office.
FedRAMP is the minimum baseline (DoD CIO, 15 Dec 2014). It is not a DISA PA and not a mission ATO.