Compliance Framework
DoD Impact Levels (IL4 / IL5 / IL6)
Meet DoD Cloud Computing SRG impact levels for controlled, mission-critical, and classified workloads.
The Department of Defense Cloud Computing Security Requirements Guide (SRG) sorts workloads into Impact Levels based on the sensitivity of the data they handle. IL4 covers Controlled Unclassified Information (CUI), IL5 raises the bar for higher-sensitivity CUI and National Security Systems, and IL6 supports classified information up to the SECRET level. Each level layers on stricter requirements for isolation, personnel, and the cloud regions where data may reside.
HanaByte architects and authorizes workloads in AWS GovCloud (US) and DoD-region environments, building the controls, boundary, and documentation that align to the target Impact Level and the DoD Provisional Authorization process.
How we help
DoD Impact Level Workshops
Scope
- Interactive workshops on DoD Impact Level processes and requirements, educating key stakeholders, technical personnel, and support teams. Sessions are used to learn more about your business.
Deliverables
- Delivery of workshops covering DoD Impact Level requirements and authorization paths.
- Regular remote meetings to track progress on a schedule that fits your team.
Personnel & timeline
- Security consultant(s) assigned to the engagement for a flat fee.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
- Provide access to relevant personnel for workshop sessions.
DoD Impact Level Advisory Services
Scope
- Guidance assessing your existing control implementations, infrastructure, policies, procedures, and documentation against DoD Impact Level requirements.
- Ongoing guidance through DoD Impact Level requirements and which priorities to address first.
Deliverables
- Regular meetings to consult on DoD Impact Level processes and close compliance gaps.
Personnel & timeline
- Security consultant(s), billed hourly as needed for the engagement.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
DoD Impact Level Gap Assessment
Scope
- Assessment of your existing controls, infrastructure, policies, procedures, and documentation to perform a gap analysis against DoD Impact Level requirements.
- Creation of a report with a detailed roadmap of remediation efforts across people, process, and technology for all unmet requirements.
Deliverables
- Detailed readiness assessment covering your environment, policies, procedures, personnel, and controls.
- Remediation plan with prioritized steps and regular meetings to track progress.
Personnel & timeline
- Security consultant(s) assigned to the engagement; expected turnaround of 4 to 6 weeks depending on scope.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
DoD Impact Level Launch
Scope
- Assessment of your existing controls, infrastructure, and documentation to perform a gap analysis against DoD Impact Level requirements.
- Workshops on DoD Impact Level processes and implementation strategies for your stakeholders and technical teams.
- Creation of a report with a detailed remediation roadmap across people, process, and technology.
Deliverables
- Detailed readiness assessment of your environment, policies, procedures, personnel, and controls.
- Delivery of workshops covering DoD Impact Level requirements.
- Remediation plan with prioritized steps and regular meetings to track progress.
Personnel & timeline
- Security consultant(s) assigned to the engagement; typical timeline of 12 to 16 weeks depending on scope.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
Frequently asked questions
What are DoD Impact Levels?
They are tiers in the DoD Cloud Computing Security Requirements Guide (SRG) that classify workloads by data sensitivity - IL4, IL5, and IL6.
What is the difference between IL4, IL5, and IL6?
IL4 covers Controlled Unclassified Information (CUI); IL5 adds higher-sensitivity CUI and National Security Systems; IL6 supports classified information up to SECRET.
Where do IL5 and IL6 workloads run?
In authorized environments such as AWS GovCloud (US) and dedicated DoD regions, with controls and personnel requirements matched to the Impact Level.
Ready to get started?
Talk to our team about DoD Impact Levels (IL4 / IL5 / IL6). We meet you where you are.
Get in touch