DoD IL4 is the Department of Defense’s Impact Level 4 security tier for hosting sensitive but unclassified information in commercial cloud environments. It covers Controlled Unclassified Information such as personnel records, export-controlled technical data, and internal mission files that haven’t been cleared for public release. To operate at this tier, a cloud service provider must meet the full FedRAMP Moderate control set plus DoD-specific enhancements, keep all data inside the United States, and restrict access to vetted U.S. persons.
Where IL4 Sits Among the DoD Impact Levels
The DoD Cloud Computing Security Requirements Guide defines a tiered system, and picking the wrong tier either underprotects sensitive data or piles on cost a project doesn’t need.
- IL2 covers information approved for public release and non-sensitive unclassified data, aligned to the standard FedRAMP Moderate baseline.
- IL4 covers Controlled Unclassified Information and other sensitive but unclassified data, adding DoD enhancements on top of FedRAMP Moderate.
- IL5 covers higher-sensitivity CUI and information tied to National Security Systems, with tighter personnel vetting and stronger isolation from commercial tenants.
- IL6 covers classified information up to SECRET and requires air-gapped infrastructure with no public internet connection.
IL3 was removed from the framework years ago, so the jump goes directly from IL2 to IL4. For most DoD components handling sensitive internal data that doesn’t rise to classified, IL4 is the working baseline.
What Data Belongs at IL4
IL4 primarily protects Controlled Unclassified Information, the designation established by Executive Order 13556 to standardize how the federal government handles sensitive unclassified material.1National Archives. Controlled Unclassified Information CUI includes technical drawings, legal case files, financial records, acquisition data, and internal policy documents agencies have decided should not be publicly released.
Personally Identifiable Information and Protected Health Information tied to military personnel also sit at IL4. Social Security numbers, medical histories, and payroll records could harm individuals or compromise readiness if exposed, and the Privacy Act of 1974 restricts how federal agencies disclose these records.2U.S. Department of Justice. Privacy Act of 1974
Export-controlled technical data is the third major category. Information restricted under the International Traffic in Arms Regulations, including defense technology on the U.S. Munitions List, must be kept away from foreign access.3Microsoft Learn. Department of Defense Impact Level 4 – Azure Compliance IL4 provides the boundary that prevents this data from sitting alongside lower-sensitivity material in commercial multi-tenant environments used by civilian agencies.
Security Controls and Infrastructure
IL4 starts with the full FedRAMP Moderate control set, roughly 325 controls covering access management, audit logging, incident response, and related areas. DoD-specific additions bring the total to approximately 369 controls, concentrated on continuous monitoring thresholds, faster vulnerability patching, and tighter identity management.
All government data in an IL4 environment must physically reside within the 50 states, the District of Columbia, or outlying U.S. areas as defined by federal acquisition regulations, unless the responsible Authorizing Official grants a specific exception.4Defense Information Systems Agency. Cloud Service Provider Security Requirements Guide This keeps the infrastructure under U.S. legal jurisdiction.
Encryption is required for data at rest and in transit using FIPS 140-validated cryptographic modules. Physical security at the data centers includes multi-factor authentication for entry and continuous surveillance of server areas.
Who Can Access IL4 Data
Cloud service provider personnel with access to IL4 systems must be U.S. citizens, U.S. nationals, or U.S. persons. Foreign nationals may not have access to IL4 data.3Microsoft Learn. Department of Defense Impact Level 4 – Azure Compliance This restriction flows from the export control and CUI protections the tier enforces. Staff working in or around IL4 data center environments also undergo background investigations, and the personnel rules limit the labor pool for data center operations and engineering roles to vetted U.S. persons only.
How IL4 Environments Connect to Users
Traditionally, IL4 cloud environments connect to defense users through DoD Internet Access Points, across the Defense Information Systems Network, and through boundary Cloud Access Points. This routes all traffic through independently managed security stacks that inspect data flows before they reach the cloud enclave.5Department of Defense. Cloud Native Access Point Reference Design
The DoD has been developing a replacement, the Cloud Native Access Point, built on zero trust principles. A CNAP lets authorized users reach IL4 resources directly from the internet through an architecture that continuously verifies identity, device health, and authorization instead of relying on perimeter network controls. Current policy still formally requires the legacy IAP-to-DISN path, but the CNAP reference design recommends updating that policy to allow direct access with proper zero trust protections.
Getting an IL4 Provisional Authorization
There are two pathways to a DoD Provisional Authorization: leveraging an existing FedRAMP authorization or having a DoD component sponsor the cloud service offering directly.6Cyber Exchange. DoD Cloud Computing Security Either way, a DoD mission owner must serve as the sponsor and submit the request through DISA’s Cloud Authorization Services team.
The authorization package starts with a System Security Plan describing how every required control is implemented, with exact system boundaries covering every server, database, network device, and software component. Vague boundaries stall reviews quickly. A Plan of Action and Milestones addresses known gaps with specific fixes and deadlines. The package also requires a Security Assessment Plan, architecture diagrams showing data flows and access points, and a DoD-specific SSP addendum. Templates are available through the DISA Cyber Exchange.6Cyber Exchange. DoD Cloud Computing Security
From there, the authorization moves through defined stages:
- Intake and kickoff, where DISA reviews the sponsor’s submission and schedules a Joint Validation Team kickoff.
- Assessment plan review, where the JVT approves the Security Assessment Plan before testing begins.
- Third-party assessment, where an independent Third-Party Assessment Organization tests the environment against every required control and the provider submits the SSP, POA&M, and Security Assessment Report.
- JVT review and remediation, where the provider and 3PAO fix issues, retest, update documentation, and respond to comments until the package is clean.
- DSAWG review, where the Defense Security/Cybersecurity Authorization Working Group provides its recommendation to the DISA Authorizing Official.
- Final decision by the DISA Authorizing Official to grant or deny the Provisional Authorization.
The timeline from kickoff to a signed PA typically spans several months. Complex environments or documentation gaps push it longer.7Defense Information Systems Agency. DoD Cloud Authorization Process Once the PA is issued, individual mission owners can grant their own Authorization to Operate for specific projects running on the approved infrastructure.
Keeping the Authorization Active
A Provisional Authorization is not a one-time event. Providers must perform monthly continuous monitoring and annual reassessments for every authorized cloud service offering.7Defense Information Systems Agency. DoD Cloud Authorization Process Vulnerability remediation follows strict deadlines: critical and high-severity findings must be resolved or mitigated within 30 days, moderate findings within 90 days, and lower-severity issues within 180 days. Missing these windows puts the authorization at risk.
Ongoing compliance carries real cost. Industry estimates for maintaining a FedRAMP Moderate-level authorization, which forms the floor for IL4, run between $200,000 and $500,000 per year across continuous monitoring tools, annual 3PAO reassessments, documentation updates, and dedicated compliance staff. Initial authorization commonly costs between $500,000 and $1.5 million when combining consulting, engineering, documentation, and assessment fees. Treating compliance as a side project rather than a permanent operational function is how authorizations get revoked.