The Defense Information Systems Agency issued a Provisional Authorization on August 15 enabling Department of Defense (DOD) mission partners and service components to host DOD Impact Level 2 (IL2) data on FedRAMP Authorized, Moderate Baseline, Cloud Service Offerings (CSO), without waiting for an explicit, DOD written authorization.
The Agency’s Risk Management Executive and Authorizing Official, Roger Greenwell, signed the blanket Provisional Authorization to streamline processes and information availability for mission partners looking to host DOD IL2 mission data in the cloud. It also reduces the steps industry partners go through prior to FedRAMP Moderate authorized solutions being available to address DOD customer needs.
Greenwell said the authorization allows for data designated publicly releasable or IL2, to be stored in the cloud on authorized FedRAMP offerings without waiting for DOD to issue a specific authorization document. “We worked with officials from the DOD, Chief Information Office, and mission partners on the drafting of the policy, and believe this approach provides significant benefit to both the DOD community as well as the cloud industry.”
This reciprocity memo applies to CSOs authorized at the FedRAMP Moderate Baseline, whose datacenters are located in the United States or its territories, and listed in the FedRAMP Marketplace. Information and associated authorization artefacts for the various CSOs are available at FedRAMP and from the Cloud Service Provider’s (CSP) listed point-of-contact.
Reciprocity is contingent upon the CSP maintaining the FedRAMP Joint Authorization Board (JAB) or agency authorization for the CSO and adhering to successful continuous monitoring practices. If the FedRAMP JAB or agency authorization is suspended, revoked, restricted, or limited in any manner, the DOD IL2 reciprocity for that CSO is considered suspended and will be explicitly revoked until all issues with the authorization are mitigated in accordance with policy.
Mission partners with questions regarding this action should contact the DOD Cloud Authorization Services (DCAS) team or the Security Control Assessor and Chief of Assessments and Authorization Division.
