So my company (SaaS) recently acquired another company that is operating a SaaS product for DoD. The product has an ATO to operate at IL5. The ATO indicates that the system and all related artifacts must stay at the IL5 level. We also sell subscriptions to non-govt customers on plain ol’ commercial AWS.

So where this is getting complicated - as mentioned, we recently acquired this company, and are doing a ton of work to rationalize processes and streamline operations. Part of this bringing the new company out of running support via email, and into a proper support helpdesk (we’re using Salesforce…allows us to track things like time to first response, time to resolution, quality reviews for responses, etc). For our commercial customers has made things much more efficient and there are far fewer things falling through the cracks now. For our govt customers, however, the process isn’t exactly seamless. For things like roster updates, questions about unexpected data, etc the artifacts required to support the customer (e.g. a csv file with a bunch of users that need to be added/removed/modified in the system) can be sent directly to the support system - our govt users can email the help desk, but rather than directly giving us the files we need over that medium they need to provide links to a CAC-enabled sharepoint site that’s controlled by the DoD unit we’re working with.

My immediate thought was to see if Salesforce (or any other provider of help desk software) could support putting us into an IL5 instance of their solution. It’s looking like everyone we talk to (SF and Service Now so far) can support putting us on an IL4 instance, but not IL5 (unless our DoD customer is willing to sign a contract with them and sponsor them for an ATO). This doesn’t work for a number of reasons, not the least of which is that our customer isn’t willing to sign up for the headache of ushering Salesforce through the ATO process and then taking on the burden of whatever annual care and feeding of that ATO they need to do.)

Note: our support staff are all required to be cleared and they all have CACs.

So taking the long way around to get to this questions - how are other companies supporting their DoD IL5 clients? Is it really all just being done over .mil email addresses and sharing stuff on govt sharepoint sites? Is there a modern helpdesk platform capable of putting us on an IL5 instance so we can directly support our customers and not have to split things across our own commercial system and govt-owned file sharing and messaging solutions? Fine if the answer is that there’s no way to do it, I’m just banging my head against the wall because Salesforce started out telling us they could support us at IL5 and then after we were ready to sign the contract to add the licenses listed an IL4 instance and have been giving us the runaround for the last two weeks. Just looking for a straight answer from anyone who’s seen this done (or, alternately, knows for sure that it can’t be done).

Thanks!