Understanding Impact Levels
How the Department of War (DOW) classifies information systems by Impact Level and what each level means for cloud hosting and compliance.
The Department of War (DOW) uses Impact Levels (IL) to classify information systems based on the damage a data breach would cause. This classification ensures each system has appropriate security measures.
Each Impact Level considers three main security aspects:
- Confidentiality: Ensuring only authorized individuals access the information.
- Integrity: Maintaining the accuracy and trustworthiness of the information.
- Availability: Guaranteeing reliable access to information for authorized users.
The Defense Information Systems Agency (DISA) developed the DOW Cloud Computing Security Requirements Guide (CC SRG) to provide security guidelines for cloud computing. This guide incorporates standards from:
- Federal Information Security Management Act (FISMA)
- National Institute of Standards and Technology (NIST) Special Publication 800-37
The CC SRG extends the FedRAMP framework with enhanced, DOW-specific security controls designed to meet the distinct demands of military and national security systems.
Overview of Impact Levels
The DOW defines several Impact Levels, each corresponding to the sensitivity of the data:
| Impact Level | Data Type | Use Case |
|---|---|---|
| IL2 | Publicly releasable information | Non-sensitive systems |
| IL4 | Controlled Unclassified Information (CUI) | Sensitive but unclassified |
| IL5 | CUI + National Security Systems (NSS) | Higher sensitivity |
| IL6 | Classified up to SECRET | Highest security requirements |
Why Impact Levels matter
If your organization wants to work with the DOW, understanding Impact Levels is essential due to the following reasons:
1. You must match the right security level
Each DOW project or system requires a certain level of protection. The Impact Level tells you:
- What kind of data you're dealing with (e.g., public, sensitive, or classified).
- Which security controls protect that data.
Your solution must meet the required Impact Level to operate in that environment.
2. It impacts your cloud hosting choices
Not all cloud platforms are authorized for every Impact Level. For example:
- IL2 can use commercial cloud environments.
- IL5 and IL6 require specially authorized environments.
This affects how and where you can deploy your software.
3. It shapes your compliance path
The higher the Impact Level, the more security and documentation you need. Knowing your target level early helps you:
- Plan your compliance and certification strategy.
- Avoid surprises later in the authorization process.
4. It builds trust with DOW partners
Demonstrating that you understand and meet the right Impact Level shows:
- You're serious about cybersecurity.
- You're a credible partner for defense work.
Game Warden environments
Game Warden environments align with DOW Impact Levels and follow a structured deployment lifecycle. Each deployment stage uses the Impact Level that matches its data sensitivity and operational purpose.
Your application is first deployed to the Game Warden Commercial environment, which serves as the development (DEV) environment for configuration, integration, and functional testing. This environment supports non-classified data and gives both your team and Game Warden customer engineering staff broad access.
During this phase, Game Warden engineers work with your team to configure the environment, resolve issues, and confirm that your application functions within the Game Warden platform before promoting it to the next deployment stage.
Your application is first deployed to the Game Warden Commercial environment, which serves as the development (DEV) environment for configuration, integration, and functional testing. This environment supports non-classified data and gives both your team and Game Warden customer engineering staff broad access.
During this phase, Game Warden engineers work with your team to configure the environment, resolve issues, and confirm that your application functions within the Game Warden platform before promoting it to the next deployment stage.
After initial onboarding, Game Warden promotes your application to the Staging (STG) environment. The Impact Level of the STG environment matches the intended Production (PRD) IL. For example, if you plan to deploy your application to an IL5 production environment, your staging environment will also operate at IL5.
This is where extensive testing and verification take place under real-world conditions. Game Warden restricts STG access based on classification and mission sensitivity.
After completing staging tests, Game Warden deploys your application to Production (PRD) at your selected IL (IL4 or IL5). Authorized end users can access this live environment, and Game Warden protects it with the full set of controls appropriate to its Impact Level.
Game Warden supports production deployments at IL4 and IL5, with IL6 support on the roadmap. Higher Impact Levels require more security controls to maintain compliance and operational integrity.
Game Warden restricts access to each environment based on the user's assigned IL. Only personnel with the appropriate credentials and authorizations can access higher-level environments such as IL5.