What Is DISA Provisional Authorization? IL-4 Guide

Every commercial cloud service that hosts Department of War (DoW, formerly the Department of Defense) data above Impact Level 2 (IL-2) needs a Provisional Authorization (PA) from the Defense Information Systems Agency (DISA) before a mission owner can put live data on it.

Most SaaS vendors first encounter the term when a DoW program manager who likes the product asks whether it holds a DISA PA at Impact Level 4 (IL-4).

Key Takeaways

• One offering, one level. DISA's Authorizing Official issues a PA for a specific Cloud Service Offering (CSO) at one Impact Level, and each mission owner still issues its own Authority to Operate (ATO) for the system running on it.  
• IL-4 is the target. It covers Controlled Unclassified Information (CUI) and accepts logical separation on commercial infrastructure, and IL-5 has been reserved for National Security Systems since July 2025.  
• FedRAMP is the floor. DISA layers Federal Risk and Authorization Management Program (FedRAMP)+ controls from the DoD Cloud Computing Security Requirements Guide (CC SRG) V1R6 on top of FedRAMP Moderate or High and runs its DISA authorization evaluation before issuing a PA.  
• PA is the gate. Mission owners must select offerings that hold a PA at the required level, and DISA can revoke a PA when continuous monitoring lapses.

A DISA PA Is DoW Approval for a Specific Cloud Service Offering

A DISA Provisional Authorization is a formal risk-acceptance decision that lets a specific commercial cloud service host DoW data at a defined Impact Level. DISA published the DoD Cloud Computing Security Requirements Guide V1R6 in December 2025, the control baseline every DoW cloud authorization is assessed against. The CC SRG describes a PA as "an acceptance of risk based on an evaluation of the Cloud Service Provider's offering and the potential for risk introduced to DoD networks."

Key characteristics of a DISA PA:

• Narrow scope. The PA attaches to one specific Cloud Service Offering (CSO) at one specific Impact Level, and only a Cloud Service Provider's (CSP's) individual offerings hold PAs.  
• Single issuing authority. The DISA Authorizing Official (AO) signs every DoW PA, with the DISA Cloud Assessment Division (CAD) supporting sponsors and mission owners through pre-screening, assessment, validation, authorization, and continuous monitoring.  
• Independent testing is required. A PA tells a DoW program manager that an independent assessment service (formerly Third-Party Assessment Organization, 3PAO) has tested the offering against the CC SRG and DISA has accepted the residual risk.  
• Provisional and reusable. The PA is provisional and reusable across DoW: any mission owner can rely on it, but that owner's own AO must still issue an ATO for the specific system running on the offering at every Impact Level.  
• Contractually binding. Defense Federal Acquisition Regulation Supplement clause 252.239-7010 makes the CC SRG a contractual requirement, and the contractor is bound to the version in effect when the solicitation was issued.

In short, a PA qualifies an offering to bid and host DoW missions, while the ATO is what puts live data on it. Because the PA is issued for one offering at one Impact Level, the next practical question for any vendor is which Impact Level actually applies to the data they plan to host.

Impact Levels Determine Which DoW Data a Cloud Service Can Handle

The CC SRG sorts DoW information into Impact Levels by data sensitivity and mission criticality, and a PA is granted at one of them. Four active Impact Levels remain. IL-1 merged into IL-2 and IL-3 into IL-4, with the original numbering kept, so IL-2, IL-4, Impact Level 5 (IL-5), and Impact Level 6 (IL-6) remain. Each step up adds controls, isolation requirements, personnel restrictions, and connectivity rules, and DoW guidance forbids hosting higher-level data on a lower-level service.

IL-2 Handles Public and Low-Sensitivity, Unclassified Data

IL-2 covers data cleared for public release plus some private unclassified information outside the CUI category that needs minimal access control. A FedRAMP Moderate or High authorization receives an IL-2 reciprocity designation, so no separate assessment is required.

IL-4 Is the Baseline for CUI on Commercial Infrastructure

IL-4 covers CUI, non-critical mission information, and non-National Security Systems. It requires FedRAMP Moderate or High plus DISA's FedRAMP+ controls, U.S. persons only for access, and DoW traffic entering through a government-controlled gateway onto the DoW's unclassified network, the Non-classified Internet Protocol Router Network (NIPRNet). Tenants can be separated logically on commercial infrastructure.

IL-5 Is Reserved for National Security Systems

IL-5 covers National Security Systems (NSS), including unclassified NSS. Under the current CC SRG, IL-5 authorization is no longer permitted for non-NSS workloads; non-NSS CUI stays at IL-4 regardless of sensitivity. To meet its physical separation requirements, CSPs typically host IL-5 workloads in dedicated cloud regions reserved exclusively for DoW customers.

IL-6 Is Reserved for Classified Data up to Secret

IL-6 covers classified information up to Secret on infrastructure cleared for classified processing, with Secret network connectivity through the Secret Internet Protocol Router Network (SIPRNet) and cleared U.S. citizens operating it.

For a SaaS vendor handling ordinary DoW CUI with no NSS use case, IL-4 is the target. IL-2 can't hold CUI, IL-5 is closed to non-NSS workloads, and IL-6 requires classified infrastructure most commercial vendors can't reach.

A DISA PA and a FedRAMP Authorization Serve Different but Overlapping Purposes

FedRAMP is the government-wide program for authorizing cloud services across federal civilian agencies, and the FedRAMP governing board and Program Management Office (PMO) govern it. A DISA PA sits on top of that program: FedRAMP is the minimum security baseline for all DoW cloud services, and the CC SRG layers DoW-specific FedRAMP+ controls and requirements on top of the FedRAMP assessment.

Where the two programs overlap:

• Shared control baseline. For IL-4, DISA requires a Moderate or High Federal Information Processing Standards (FIPS) 199 categorization, a current Rev5 baseline set by Certification Class, plus DISA's added parameter values, the FedRAMP requirements, and applicable FedRAMP+ control enhancements.  
• Reciprocity at IL-2. A FedRAMP Moderate or High authorization alone is designated IL-2 via reciprocity, with no separate DISA assessment required.  
• Focused DISA evaluation at IL-4 and IL-5. DISA's assessment focuses on the FedRAMP+ delta rather than retesting the full FedRAMP control set, and it assesses personnel, separation, and connectivity rules as non-control requirements.  
• Combined independent assessment. Having one independent assessor evaluate FedRAMP and DoW requirements at the same time removes duplicate testing.  
• Aligned but distinct naming. FedRAMP's Consolidated Rules for 2026, released June 24, 2026, with mandatory adoption beginning January 1, 2027, set current Rev5 baselines by Certification Classes A through D rather than by FIPS 199 security category, which keeps them distinct from the DoW Impact Level system.

Those combined baselines define the assessment work required for a PA.

Getting a DISA PA Requires Passing an Independent Assessment

The DoD Cloud Computing Security portal (DCCS) describes two pathways to a PA: building on an existing FedRAMP authorization or having a DoW component sponsor a separate assessment. Both follow the same five-step sequence, beginning with sponsorship and ending with continuous monitoring.

1. Secure a DoW Sponsor and Scope the Offering

A mission owner or component sponsor must back the effort before DISA's assessment can begin, and the sponsoring organization resources the assessment in coordination with the DISA team. Scoping fixes the target Impact Level, IL-4 or IL-5, based on the data the offering will hold.

2. Build on FedRAMP and Engage an Independent Assessor

For IL-4, the CSP first holds FedRAMP Moderate or High. A FedRAMP-recognized independent assessor then tests the FedRAMP+ controls and DoW-specific requirements and produces the test plan, the assessment report including penetration test results, and the DoD Readiness Assessment Report DISA requires for a first assessment.

3. Submit the Authorization Package to DISA CAD

The package includes the System Security Plan (SSP), the assessment report, a continuous monitoring strategy, and current FedRAMP Vulnerability Detection Report (VDR) and Vulnerability Exploitability Report (VER) data.

Under current FedRAMP rules, agencies maintain Plans of Action and Milestones (POA\&Ms); DISA may impose additional DoW-specific remediation-reporting requirements. CAD pre-screens and validates the package.

4. Receive the DISA AO Decision

The AO issues the PA with conditions and usage considerations for mission owners, and the offering is listed in the DoD Cloud Catalog maintained by the DoD Cloud Authorization Services (DCAS) team. An offering that falls short receives POA\&Ms to work on or is told to remediate and resubmit.

5. Maintain Continuous Compliance Through ConMon

Continuous Monitoring (ConMon) enforces continuous compliance. The CC SRG requires monthly vulnerability scans and annual assessments. Under current FedRAMP rules, providers submit VDR/VER vulnerability data and agencies maintain POA\&Ms; DISA may impose additional DoW-specific monthly remediation-reporting requirements. Required monitoring materials go to DISA, which distributes them to every mission owner using the offering. The DISA AO can revoke a PA for an unapproved change that alters the risk posture.

The step 2 assessment uses the CC SRG, which is aligned to National Institute of Standards and Technology (NIST) SP 800-53 Rev5 (September 2020). The current CC SRG requires implementing every listed control as written rather than substituting an equivalent.

A DISA PA Gives DoW-Ready Vendors a Durable Market Advantage

For SaaS vendors, a DISA PA is not just a compliance milestone; it is a procurement asset. Because the CC SRG binds mission owners to select PA-qualified offerings above IL-2, an authorization decision translates directly into competitive access to DoW contracts, a shorter path through downstream ATOs, and a verifiable risk signal that program managers and contracting officers can confirm in DISA's public catalog. The advantages compound over time, but they also require the vendor to sustain certain conditions.

• Establishes procurement eligibility above IL-2. Mission owners must select a PA-qualified offering at the required Impact Level, so a PA is the ticket into DoW competitions and production use.  
• Compresses every downstream ATO. Each mission owner inherits the PA's body of evidence instead of assessing the offering from the beginning.  
• Acts as a verifiable risk signal. Program managers and contracting officers can check DISA's list of authorized offerings, and a listed PA removes the authorization question from source selection.  
• Is not an endorsement. DISA doesn't endorse offering suitability for any particular requirement, so vendors still compete on fit and performance.  
• Carries an expiration date. PAs come with continuous monitoring conditions and annual assessments the CSP must maintain and renew to keep the authorization active.  
• Serves as the documented base for IL-5. An IL-4 offering with a FedRAMP High categorization can carry some control evidence forward, but IL-5 adds physical separation requirements and requires its own DISA PA.

That procurement advantage becomes even more practical when the assessment work itself can be inherited. Instead of standing up a private IL-4 boundary and carrying the full FedRAMP baseline and FedRAMP+ delta alone, a vendor can deploy inside a pre-authorized boundary that already holds a PA and inherit its assessed controls, shifting most assessment costs off the vendor and shortening time to authorization.

Start Your IL-4 Path With an Inherited Boundary

The fastest way to a DISA PA is to reuse existing authorization work. Building a private IL-4 boundary means carrying the full FedRAMP baseline, the FedRAMP+ delta, and continuous monitoring on your own, a program that stretches across quarters and consumes engineering capacity a SaaS team would rather spend on product. Deploying inside a pre-authorized boundary flips the equation: assessed controls are inherited, monitoring obligations are shared, and time to authorization drops from years to months.

Knox Systems operates a government cloud platform built on that inheritance model, letting SaaS vendors deploy inside a boundary that already holds FedRAMP Moderate, FedRAMP High, and DISA IL-4, with IL-5 in process. The result is a predictable path to authorization in roughly 90 days and at about 90% less cost than the traditional route.

Book a demo with Knox to map your offering to the IL-4 path.

FAQs about DISA Provisional Authorization

Does a Knox-Hosted IL-4 Path Require Containerization?

No. SaaS vendors can bring their existing architecture into the pre-authorized Knox FedRAMP boundary without containerizing the application.

Which Cloud Providers Support the Knox IL-4 Path?

The Knox FedRAMP boundary supports Amazon Web Services, Azure, and Google Cloud Platform within a single multi-cloud environment.

How Does Knox Automate Remediation During Authorization?

Knox's automated continuous monitoring platform ingests infrastructure data, detects violations, and generates remediation code, including Terraform scripts.

What Delivery Models Are Available for Authorization Work?

Knox offers a fully managed service and a self-service platform subscription for organizations with internal compliance and engineering teams.

‍