.svg){kind=icon}
A DoD cloud impact level (IL) is a Department of Defense categorization of how sensitive the data in a cloud system is and how damaging its loss would be, used to set the security controls a cloud service must meet before it can host that data; the levels in use are IL2, IL4, IL5, and IL6.
Also called DoD cloud impact levels or simply impact levels.
Impact levels are defined in the Defense Information Systems Agency's Cloud Computing Security Requirements Guide, the authoritative framework a cloud service provider is measured against before it can be authorized to hold DoD data (DISA, DoD Cloud Computing Security Requirements Guide, via the DoD Cyber Exchange). The higher the level, the more sensitive the data and the stricter the controls.
For anyone fielding AI for defense, the level matters directly: an AI capability can only operate on data it is accredited to touch, so the impact level of the mission data sets the accreditation bar the capability has to meet.
Key takeaways
Bottom line: the levels step up with data sensitivity. IL2 and IL4 cover unclassified data; IL5 covers the most sensitive unclassified and national-security-system data; IL6 crosses into classified (SECRET). IL1 and IL3 existed historically but are no longer used in practice.
| Level | Data it covers | Where it can run |
|---|---|---|
| IL2 | Non-controlled unclassified / public-release information | Commercial cloud with baseline controls |
| IL4 | Controlled Unclassified Information (CUI) | DoD-authorized commercial cloud |
| IL5 | Higher-sensitivity CUI and unclassified national security systems | DoD-authorized cloud with dedicated resources and U.S.-citizen administration |
| IL6 | Classified information up to SECRET | Dedicated, isolated enclave on the SECRET network; commercial cloud not authorized |
The practical reading: IL4 and IL5 are both unclassified, but IL5 adds the most sensitive CUI and national security systems, with stricter separation and personnel requirements. IL6 is the categorical jump, from unclassified to classified, and with it the requirement for dedicated, isolated infrastructure.
The levels are cumulative in rigor, and two steps matter most:
The evaluator's takeaway is that the IL5-to-IL6 line is the one that most changes what is possible: below it, authorized commercial infrastructure can play a role; at IL6, the deployment has to be dedicated and government-controlled.
A common point of confusion: there is no official IL7. The DoD cloud impact levels defined in the Security Requirements Guide stop at IL6, which covers classified data up to SECRET. Data classified above SECRET, top secret and sensitive compartmented information (TS/SCI), lives on the Joint Worldwide Intelligence Communications System (JWICS), a separate environment that is not a cloud impact level.
The term "IL7" circulates informally as shorthand for "the TS/SCI tier above IL6," and some architecture discussions use it that way. But it is not an official accreditation level, and a capability that advertises an "IL7 accreditation" is misusing the terminology, which is a useful tell when evaluating one. The accurate way to describe that tier is the TS/SCI or JWICS environment, not an impact-level number.
These terms travel with impact levels and are easy to conflate. The table separates them.
| Term | What it is | Relationship to impact levels |
|---|---|---|
| FedRAMP | The federal program for authorizing commercial cloud services | The baseline IL4 and IL5 build on; DoD adds impact-level overlays on top of FedRAMP authorization |
| CUI | Controlled Unclassified Information | The data category that defines IL4, and higher-sensitivity CUI that helps define IL5 |
| National security system (NSS) | A system involving intelligence, cryptologic, or command-and-control functions | Part of what pushes an unclassified system to IL5 |
| Classification level | Unclassified, SECRET, TOP SECRET, and SCI markings on the data itself | Impact levels map to classification: IL2/IL4/IL5 unclassified, IL6 SECRET, TS/SCI above IL6 |
For defense AI the rule is simple and consequential: a capability can only operate on data it is accredited to handle, so the impact level of the mission data sets the bar the AI has to clear. An AI that exists only in a commercial cloud region cannot serve an IL6 mission at all, and even IL5 work carries dedicated-infrastructure and personnel requirements that a general commercial service may not meet.
This is why ownership and deployment model matter most at the higher levels. A capability the government can run on its own infrastructure can operate at IL5 and IL6, including the dedicated, isolated environments IL6 requires, where a commercial-cloud-only tool cannot. It is the same reasoning behind AI at the tactical edge, where the classification bar has to be met with no reliable connection, and cross-domain data integration, where data spans several of these levels at once. Torch.AI builds reasoning infrastructure the customer can own and govern, deployable government-owned (GOTS) at the impact levels a mission requires; see the Torch.AI software page, or request a technical walkthrough.
What are the DoD cloud impact levels? They are DoD categorizations, IL2, IL4, IL5, and IL6, of how sensitive data is and how damaging its loss would be, which set the security controls a cloud service must meet to host that data. They are defined in DISA's Cloud Computing Security Requirements Guide. IL1 and IL3 existed historically but are no longer used.
What is the difference between IL5 and IL6? IL5 covers higher-sensitivity CUI and unclassified national security systems; IL6 covers classified information up to SECRET and must run on dedicated, isolated infrastructure that commercial clouds are not authorized to host. The IL5-to-IL6 step is the move from sensitive unclassified to classified. See the levels table.
What is the difference between IL4 and IL5? Both are unclassified, but IL5 covers higher-sensitivity CUI and unclassified national security systems, with stricter separation and, in practice, dedicated infrastructure and U.S.-citizen administration beyond IL4.
Is there a DoD IL7? No. The official DoD cloud impact levels stop at IL6 (classified up to SECRET). Top secret and SCI data lives on JWICS, a separate environment that is not a cloud impact level. "IL7" is informal shorthand for that TS/SCI tier, and a capability claiming "IL7 accreditation" is misusing the term.
Do impact levels apply to AI? Yes. An AI capability can only operate on data it is accredited to handle, so the impact level of the mission data sets the accreditation bar. At IL6, and for the dedicated requirements of IL5, that favors a government-owned deployment the customer can run on its own infrastructure.