The DoD CC SRG in one paragraph
The DoD Cloud Computing Security Requirements Guide (CC SRG) is the DoD's overlay on top of FedRAMP. It defines Impact Levels 2 through 6 based on data sensitivity: IL2 for public-facing DoD data, IL4 for CUI, IL5 for mission-critical CUI and unclassified National Security Systems, and IL6 for SECRET-classified workloads. Each level adds DoD-specific requirements on top of the FedRAMP baseline, and the deltas are narrower technically than operationally. The assessment of intent is run by a DoD 3PAO; the authorization is issued by DISA as a Provisional Authorization that DoD components then adopt.
IL4 vs IL5: what actually changes
The control-baseline delta from IL4 to IL5 is narrow. What changes is the evidence bar and the operational discipline behind the controls.
IL5 adds explicitly: - National-affiliation limits on personnel — per SRG 5.5.2, personnel with access to systems processing or storing DoW CUI at IL4/5 must be U.S. Citizens, U.S. Nationals, or U.S. Persons; no Foreign Persons. Citizens-only applies at IL6. This rule is the same at IL4 and IL5, so it is a FedRAMP-to-DoD step rather than an IL5 delta — but the SRG treats all personnel with system access as administrators for this purpose, and the HR-to-IdP integration evidence is the hard part, not the policy. - FIPS 140-validated cryptography at every boundary: not "FIPS-compliant," not "uses approved algorithms," but CMVP-validated modules on the active validation list. - Deeper supply-chain evidence — SBOMs, dependency provenance, update integrity, third-party assessment artifacts. - Stricter continuous monitoring — monthly cadence that withstands sustained assessor scrutiny over multiple review cycles.
IL5 assessments routinely extend by 30–60 days when any one of these is underestimated. We plan explicitly around each.
IL6 and the classified tier
IL6 sits above IL4 and IL5 on the CC SRG scale and covers SECRET-classified workloads. Running at IL6 requires classified-region infrastructure (AWS Secret Region, Azure Government Secret), personnel clearances, dedicated facility clearances, and a different operational model from IL4/IL5.
Few commercial CSPs pursue IL6 directly; most get there through a progression from IL5 plus classified-customer pull. When IL6 is the target, the engagement is as much about the program security and classified-network integration as it is about cloud configuration, which is where our classified-networks practice and our cloud practice converge.
Who needs DoD CC SRG authorization?
Any cloud service provider with a DoD customer that handles DoD CUI (IL4), mission-critical CUI or unclassified NSS (IL5), or classified data (IL6). CSPs that start with a federal-civilian FedRAMP authorization often discover a DoD opportunity requires the CC SRG overlay, not as a replacement for FedRAMP but as an additional layer.
Typical customer-driven triggers: a DoD program office expressing interest, a prime contractor flowing down a cloud-hosted CUI requirement, or a DoD component mandate to move a workload from an on-premise system to a cloud service.
Why Fortinetics for DoD IL authorizations
We understand the delta from FedRAMP. We have run CSPs from clean FedRAMP Moderate ATO to IL4 PA and from IL4 to IL5 repeatedly. The delta (personnel affiliation evidence, FIPS 140 boundary discipline, DISA PA review cycle management) is where engagements slip. We plan around each specifically, not generically.
We work where commercial clouds end. Our classified-networks practice handles the IL5/IL6 boundary: the transition from commercial cloud infrastructure to the classified tier. Few compliance firms operate credibly at both ends of this spectrum.
Parallel framework execution. Many CSPs targeting IL4/IL5 also need CMMC Level 2 (as the contractor), FedRAMP Moderate or High (as the cloud service), and sometimes SOC 2 for commercial customers. Running these in parallel with shared controls and a shared evidence pipeline is the only way to keep the program costs manageable.