DISA approves Google to host more sensitive DOD cloud data

Google Cloud received the Defense Department’s Impact Level 5 (IL5) security authorization from the Defense Information Systems Agency, it announced Tuesday.

The cybersecurity designation gives the technology giant approval to host some of the military’s most sensitive (but not top secret) data, including workloads associated with defined National Security Systems.  

The new designation is the result of “a rigorous assessment of physical, logical, and cryptographic isolation controls,” according to a statement shared with DefenseScoop. 

It comes as the major technology player vies with Amazon Web Services, Microsoft and Oracle for contracts via the DOD’s Joint Warfighting Cloud Capability (JWCC) plan for an advanced infrastructure enabled by multiple commercial vendors. 

“This authorization will provide the warfighter another safe, secure cloud hosting capability to store and process mission-critical information,” Lt. Gen. Robert Skinner, DISA director and Joint Force Headquarters-Department of Defense Information Network commander, said Tuesday.

DOD relies on its “Impact Level” classification system to categorize data and securely authorize cloud-based hosting environments. IL5 encompasses the highest level of authorization granted to environments built to store and process controlled unclassified information (CUI), as well as what’s considered mission-critical and national security systems information. 

This new designation from DISA, according to the agency’s release, affirms the following Google services: BigQuery, Cloud Hardware Security Module, Cloud Key Management Service, Google Cloud Storage, Google Compute Engine, Persistent Disk, Identity and Access Management and Virtual Private Cloud.

In a draft blog post viewed by DefenseScoop ahead of its release, an executive from the company said it is “committed to rapidly expanding the number of Google Cloud services within the IL5 authorization boundary.” 

Different federal agencies abide by different security protocols. For DOD, beyond IL5 is IL6 — a rigid compliance standard that is required to process classified data for cloud-based defense workloads. Cloud service offerings from AWS, Microsoft and Palantir have been authorized to operate at IL6, so far.

“Google Cloud will pursue the IL6 certification for classified work,” a spokesperson told DefenseScoop on Tuesday.