What Impact Level Is Your Product Authorized At?
A vendor's guide to the impact-level question: which level your data calls for, why FedRAMP High is not enough, and how to answer a questionnaire honestly.
Read the postA vendor's guide to the impact-level question: which level your data calls for, why FedRAMP High is not enough, and how to answer a questionnaire honestly.
Read the postFedRAMP's 2026 rules ask whether an image is clean now. We rescanned our hardened OpenProject images: what had drifted, and what the scanner could not see.
Read the postA single authorization can span classification levels. Whether it can span yours depends on whether your domains sit under one authorizing official, and what to do when they do not.
Read the postStanding up a CUI environment beside an unchanged classified estate adds a third boundary and raises cost. The version that pays has one precondition worth checking first.
Read the postVirtualization licensing escalation is real and worth acting on. It is still not where the money is in a cleared air-gapped estate, and pitching it as the payback will not survive contact.
Read the postFor the program manager or IT lead told to shrink an underused classified environment: why cutting seats will not deliver the saving, and what to propose instead.
Read the postEvery architecture change triggers a security impact assessment, which consumes the capacity the change was meant to free. That trap, and how estates get out of it.
Read the postNeither the network nor the classification names an approval. What actually gets signed for a classified deployment, and by which authority.
Read the postControl inheritance is where authorization cost goes to die. An air-gapped on-premises estate inherits nothing, and two independent boundaries pay the full bill twice.
Read the postImpact levels are not a classification ladder, three of the four are unclassified, and since 2025 IL5 turns on a narrow statutory NSS test.
Read the postA base needed backflow tracking software. The security clause asked for something no vendor that size could hold, and the arithmetic was decided before the RFQ was written.
Read the postThe total cost of an air-gapped classified estate is the wrong number to argue about. Cost per person who actually gets work done in it is the number that changes decisions.
Read the postClassification level and compartmentation are independent axes. What collateral, SCI and SAP mean, and why cleared staff may still lack access.
Read the postThe target architecture once compute and transport both move to enterprise: what it saves, and what changes for the program office.
Read the postWhich of NIPRNet, SIPRNet and JWICS carries what, under DISA's official names, and why 'it's on SIPR' does not mean the data is Secret.
Read the postBlack core transport, CSfC commercial encryption, and policy-driven networking for classified data, and what each means for authorization.
Read the postDedicated circuits and parallel network infrastructure per weapon system. What it costs, and why the enterprise network already exists.
Read the postMOSA and NGC2 make weapon system components swappable. The authorization boundary is drawn around the whole system. What that costs, and how to redraw it.
Read the postEnterprise data platforms get built and then sit unused. The operating model problem behind it, and what makes adoption actually happen.
Read the postWhat SBIR and STTR Phase II awardees hit at transition: a security task already written into the work plan, CMMC on their own systems, and a product that will not deploy as it is.
Read the postA phased migration off dedicated weapon system infrastructure: the waves, the math, and where the recovered budget goes.
Read the postThe assumption that dedicated infrastructure is more reliable, tested against systems already running on enterprise platforms.
Read the postDedicated servers, storage and staff per weapon system. Why that cost became invisible, what it includes, and what the numbers look like.
Read the postThe lowest bid often carries the highest authorization cost. Where that cost hides, how it kills projects, and what to ask for before award.
Read the postRadar, sensor and C2 systems ship software that needs its own authorization path. What surfaces late, and how to scope it before delivery.
Read the postFive questions that separate a vendor who has actually deployed to a hardened DoD baseline from one who only assumes they can.
Read the postThe integration and O&M cost that lands on the receiving IT team after delivery, why nobody estimates it, and what a program office can do.
Read the postWhat breaks when a commercial app first meets a hardened DoD baseline: Kyverno admission failures, image provenance, and what the model got wrong.
Read the postWhy a DoD authorization cost estimate defaults to worst case, and what replacing unknowns with deployment findings does to the ATO cost estimate.
Read the postDeploying OpenProject into a hardened DoD enclave on Big Bang: hardened Ruby image, managed PostgreSQL, Kyverno admission, and the 10 findings deployment produced.
Read the postWhy Millabs runs a private Big Bang instance, and which deployment failures it catches weeks before a program-office platform ever sees your container.
Read the postAn architecture model predicted 27-32 findings. The deployment produced 10. Why both numbers matter for authorization timeline and cost.
Read the postWhat an enclave fit study delivers: hardened Dockerfiles, a CI/CD pipeline, operational manifests, and a scoped finding register, not advice.
Read the postGovernment data, contractor data, and several programs in one authorized system: who owns what, and what surfaces at the first incident.
Read the postNo managed database in a DoD enclave: what it costs to containerize PostgreSQL or MSSQL on a hardened baseline, and when to redesign instead.
Read the postThe ATO integration cost nobody scopes: what the receiving IT team needs at handoff, and who pays for it when it is missing from the estimate.
Read the postSensors, weapon systems, and embedded platforms all ship software, and that software needs an ATO. What hardware programs miss when they scope RMF.
Read the postOne product's path from a Docker image to IL-4 and TOP SECRET on JWICS: the gates it passed, the rework it took, and the timeline that held.
Read the post