Also known as: dod impact levels · impact level 5 · IL5 · IL4 · dod il4 · dod cloud impact levels
The Department of Defense's system for classifying how sensitive cloud-hosted government information is, ranging from IL2 (low-sensitivity unclassified) up to IL6 (classified up to and including SECRET).
DoD Impact Levels (IL) are the Department of Defense's framework for categorizing the sensitivity of information stored or processed in a cloud service, defined in the DoD Cloud Computing Security Requirements Guide (SRG), which is maintained by the Defense Information Systems Agency (DISA). The levels in current use are IL2, IL4, IL5, and IL6: IL2 covers non-controlled unclassified information, including data approved for public release and other low-sensitivity unclassified data; IL4 covers Controlled Unclassified Information (CUI), non-CUI that still requires protection, and mission-critical information; IL5 covers higher-sensitivity CUI, mission-critical information, and unclassified National Security Systems (NSS), and requires stronger isolation than IL4; and IL6 covers classified information up to and including SECRET. IL1 and IL3 were retired, with their scope folded into IL2 and IL4 respectively, so you will rarely see them referenced today. DoD IL is the DoD's own framework and is distinct from FedRAMP's Low, Moderate, and High baselines, though the two are related because DoD IL builds on FedRAMP baselines. A DoD IL authorization is a Provisional Authorization (PA) issued by DISA. For a defense startup, the IL level it operates at reflects the sensitivity of the government data it handles, which in turn shapes its cyber and contractual risk profile.
Source: DoD Cloud Computing SRG (DISA)
They are the DoD's categories for the sensitivity of information handled in a cloud service, defined in the DoD Cloud Computing SRG maintained by DISA. The levels in current use are IL2 (non-controlled unclassified information and data approved for public release), IL4 (Controlled Unclassified Information and mission-critical information), IL5 (higher-sensitivity CUI and unclassified National Security Systems), and IL6 (classified information up to and including SECRET). IL1 and IL3 were retired and folded into IL2 and IL4.
Both levels cover Controlled Unclassified Information, but IL5 is reserved for higher-sensitivity CUI, mission-critical information, and unclassified National Security Systems (NSS), and it requires stronger isolation than IL4. In short, IL5 handles more sensitive data and demands tighter separation between DoD and non-DoD workloads.
FedRAMP uses Low, Moderate, and High baselines for federal cloud security generally, while DoD IL is the DoD's own framework layered on top of those baselines. DoD IL builds on FedRAMP, and a DoD IL authorization is a Provisional Authorization (PA) issued by DISA rather than a FedRAMP Authority to Operate.
Definitions are educational and may be modified by your specific policy language, endorsements, and state rules. For regulatory guidance, refer to the California Department of Insurance or the NAIC.
Last updated: July 2026.