Choose an Authorization Path
Choose your authorization path based on your target environment and compliance needs.
Before onboarding your application to Game Warden, choose the authorization path that matches your target deployment environment. Your authorization path determines the compliance framework, authorization artifacts, security controls, and ongoing compliance activities required for your application.
Your choice determines:
- Which compliance framework your application must meet
- Which authorization artifacts you must produce
- Which security controls and ongoing compliance requirements apply
Choosing the correct authorization path before onboarding helps avoid delays and prevents having to repeat portions of the authorization process later.
Deployment paths at a glance
The following table compares the three deployment paths based on their target audience, required authorizations, and compliance frameworks.
| Deployment Path | Best For | Authorization | Compliance Framework | Typical Environment |
|---|---|---|---|---|
| Department of War (DOW) | Military missions and Department of War programs | Software Approval | Department of Defense Risk Management Framework (RMF) | IL2, IL4, IL5, IL6 |
| FedRAMP | U.S. federal civilian agencies | Authorization to Operate (ATO) | FedRAMP | Low, Moderate, High |
| Commercial | Development, testing, private-sector delivery | None | SOC 2, ISO 27001 (or organization-specific controls) | Commercial cloud |
What are the Game Warden deployment paths
Choose the DOW deployment path if your application supports military missions or operate in Department of War environments.
This deployment path follows the RMF and requires your application to receive Software Approval.
What you need to know:
Your application's Impact Level (IL) reflects the sensitivity of the data it processes.
| Impact Level | Description |
|---|---|
| IL2 | Public, unclassified information |
| IL4 | Controlled Unclassified Information (CUI) |
| IL5 | Mission-critical CUI requiring enhanced protection |
| IL6 | Classified information up to the Secret level |
The deployment environment is typically NIPRNet or another Department of War-approved environment.
Choose the DOW deployment path if your application supports military missions or operate in Department of War environments.
This deployment path follows the RMF and requires your application to receive Software Approval.
What you need to know:
Your application's Impact Level (IL) reflects the sensitivity of the data it processes.
| Impact Level | Description |
|---|---|
| IL2 | Public, unclassified information |
| IL4 | Controlled Unclassified Information (CUI) |
| IL5 | Mission-critical CUI requiring enhanced protection |
| IL6 | Classified information up to the Secret level |
The deployment environment is typically NIPRNet or another Department of War-approved environment.
Choose the FedRAMP deployment path if your application supports U.S. federal civilian agencies that require FedRAMP authorization.
Applications in this deployment path must have a FedRAMP Authorization to Operate (ATO) before deploying the application to production.
What you need to know:
FedRAMP categorizes systems using FIPS 199 impact levels:
- Low
- Moderate
- High
During authorization, you will typically:
- Develop a System Security Plan (SSP)
- Complete a Third-Party Assessment Organization (3PAO) assessment
- Remediate findings using a Plan of Action and Milestones (POA&M)
- Take part in Continuous Monitoring (ConMon) after authorization
Continuous Monitoring includes:
- Scheduled vulnerability scanning
- Incident reporting
- Multi-factor authentication (MFA)
- Encryption requirements
- Ongoing security assessments
Choose the commercial deployment path to develop, test, and test your application before pursuing government authorization.
Organizations begin in the commercial deployment path to test their application before moving to either the DOW or FedRAMP deployment paths.
What you need to know:
Commercial deployment provides a streamlined environment that allows teams to:
- Iterate on their application
- Resolve vulnerabilities before government authorization
- Test deployment workflows
- Become familiar with the Game Warden platform
Unlike government deployment paths, Commercial deployment does not require government authorization before deployment.
Industry-standard security controls are still applied, but government-specific compliance requirements do not.
Which path is right for your application
Use the following decision table to determine which deployment path matches your customer and deployment environment.
| If your application is for: | Choose: |
|---|---|
| Department of War mission or military program | DOW |
| U.S. federal civilian agency | FedRAMP |
| Commercial customers | Commercial |
| Internal development or testing | Commercial |
| Validating your application before government authorization | Commercial |
Still unsure which path fits your business objectives? Contact your Second Front account representative for further guidance.
FAQs
Can I start in Commercial and later move to FedRAMP?
Yes. Many organizations begin in the Commercial deployment path to test their application and resolve vulnerabilities before pursuing FedRAMP authorization.
Can I start in Commercial and later move to the Department of War deployment path?
Yes. Use a commercial deployment as your starting point before pursuing Department of War authorization.
What is the difference between DOW and FedRAMP?
The Department of War (DOW) deployment path supports military missions and Department of War environments using the Department of Defense Risk Management Framework (RMF).
The FedRAMP deployment path supports U.S. federal civilian agencies and follows the FedRAMP authorization process.
What if I don't know which deployment path I need?
If you're unsure which deployment path best fits your application or business objectives, contact your Second Front account representative before beginning onboarding.
Choosing the correct deployment path early helps prevent authorization delays and avoids unnecessary rework later.