Introducing PFCS Forward: Extending IL5/IL6 Authorization from Cloud to Edge
Integrated systems that solve meaningful problems for commanders and their warfighting requirements are essential, according to Lieutenant General Paul T. Stanton, Director of DISA and Commander of DoD Cyber Defense Command, at DISA’s Forecast to Industry 2025 (December 8, 2025)
Hardware-Agnostic Accreditation Brings IL5 and IL6 Authorization from the Cloud to the Tactical Edge
Authorization overhead has become a fundamental constraint on the speed at which capability reaches warfighters. PFCS Forward removes that constraint by extending Palantir’s “authorize once, use many” model from cloud to on-premises and edge environments.
Modern military operations require computing power co-located with warfighters, not backhauled thousands of miles to the Continental US (CONUS). Backhauling mission data from forward-deployed forces introduces latency that puts warfighters at risk and degrades decision quality. This requires deploying critical warfighting capabilities at the edge, connected through resilient infrastructure and a common data layer.
A major barrier? Authorization. Each on-premises or edge deployment has historically required customer-specific authorization packages, consuming hundreds of hours of engineering time and delaying capability delivery by months. Software vendors face the same challenge: even when deploying containerized applications, they must re-document infrastructure security controls for each environment.
Palantir Federal Cloud Service (PFCS) solved this challenge for hyperscaler clouds with IL5 and IL6 Provisional Authorizations (PAs) from DISA, enabling an “authorize once, use many” model that dramatically accelerates time-to-value. Today, we’re announcing PFCS Forward, extending the same software capabilities and security authorization model to on-premises and edge environments.
What Is PFCS Forward?
PFCS Forward is a broadening of Palantir’s PFCS IL5 and IL6 Provisional Authorizations from DISA to include on-premises and edge deployments. PFCS Forward extends the PFCS cloud to the tactical edge for the complete Palantir software stack: Foundry, Gotham, Apollo, Rubix, and AIP. That software baseline also provides the ability to accelerate deployment and accreditation for third-party software deployed via Mission Manager. PFCS Forward offers government and industry the following advantages over traditional software deployment pathways:
- Authorize Once, Deploy Everywhere: With PFCS Forward, the Palantir Platform is accredited to deploy from enterprise data centers to tactical edge nodes. Third-party software deployed via Mission Manager can inherit the Platform-as-a-Service (PaaS) layer from this authorization framework to accelerate its accreditation and run across hybrid cloud/edge architectures and different networks. Apollo, Palantir’s autonomous CI/CD platform, manages software delivery across these environments. This combination — inheritable security controls plus accredited deployment infrastructure — provides maximum optionality in target environments with minimal accreditation overhead, ultimately accelerating time to value for warfighters.
- Choose Your Hardware: PFCS Forward accredits the software while enabling great flexibility in the hardware infrastructure. PFCS Forward allows customers to tailor their deployment to the infrastructure required to meet mission requirements, from large-scale data centers to ruggedized servers in tactical vehicles. Customers remain responsible for hardware security and accreditation, but PFCS Forward’s software authorization transfers across any accredited hardware. The software controls and authorization are the same whether you’re deploying to a multi-rack facility in the Pacific or a small form factor device in a mobile command post.
- Build a Multivendor Hardware/Software Ecosystem: PFCS Forward provides the governance framework for a flexible multivendor hardware/software architecture with low switching costs for infrastructure or applications. PFCS Forward accredits the Palantir PaaS and data layer with open and extensible APIs that enable government and industry to quickly adopt new capabilities without completely reworking the governance framework. This unblocks accreditation as an impediment to fielding new capabilities at commercial speed.
- Integrate Security Across the Stack: PFCS Forward implements security controls that span from hardened container orchestration and compute through application services to Ontology-level access controls. This eliminates the security gaps that emerge when stitching together disparate products, and ensures that security controls are consistently implemented across capabilities and environments.
PFCS Forward benefits both government and industry. Government customers inherit a proven security architecture and reusable authorization package that eliminates months of assessment and documentation. Customers are able to focus their cybersecurity workforce on mission-relevant threats and site-specific controls rather than securing the entire software baseline from scratch. For industry partners, Mission Manager extends from cloud to edge, providing a fully managed and accredited Kubernetes environment that abstracts hardware variations and significantly reduces the authorization burden. Vendors focus on their capabilities and application-level security controls rather than implementing and documenting infrastructure.
How It Works: Extensible governance via Rubix, Apollo, and Ontology
PFCS Forward’s capabilities rest on three core technologies that enable secure, compliant software delivery across diverse infrastructure.
Rubix is Palantir’s hardened Kubernetes infrastructure platform, engineered specifically for regulated and mission-critical environments. While Kubernetes provides container orchestration, Rubix adds the security hardening and compliance controls required for Department of War (DoW) operations — including network segmentation with Cilium, pod security contexts, immutable infrastructure, and multi-tenant isolation. Rubix provides a consistent runtime for software developers across infrastructure form factors, from large-scale OCONUS data centers to resource-constrained edge deployments.
Apollo is Palantir’s autonomous software deployment platform, managing the full lifecycle of software from test through production across heterogeneous infrastructure. For PFCS Forward, Apollo enables secure, compliant software updates at scale — even in air-gapped edge environments. Apollo provides compliance-aware change management, support for disconnected operations through delta-based updates and local caching, continuous vulnerability management with Software Bill of Materials (SBOM) integration, and automated rollback on degradation detection.
The Ontology is the decision-centric data and orchestration system in Palantir AIP, Foundry, and Gotham. A given ontology transforms disparate data sources into an object-oriented representation of operations — people, assets, missions, and their relationships; and connects disparate logic, such as forecasts and optimization algorithms, into reusable functions and actions which can power collaborative human and agentic workflows. Rather than forcing applications to integrate directly with dozens or hundreds of underlying systems, the Ontology provides a unified API that maintains data lineage, enforces granular access controls, and preserves semantic meaning from source to decision. The Ontology implements role-based (RBAC), attribute-based (ABAC), and classification-based access controls (CBAC), enabling granular governance on who is accessing data, their role and attributes (clearance level, need-to-know, organizational affiliation), and the specific properties being accessed, both within the Palantir Platform and to third-party applications interoperating via Ontology Software Development Kits (OSDKs). With PFCS Forward, the Ontology and OSDK extend from cloud to edge, enabling the broader defense tech ecosystem to develop applications that leverage authoritative data, logic, and workflow primitives in a secure and consistent manner.
Together, these three technologies make governance inheritable. The PFCS Forward accreditation package defines how Rubix enforces platform security, how Apollo manages compliant software delivery, and how the Ontology implements data-level access controls. That governance framework then extends to every environment where PFCS Forward deploys, from cloud data centers to OCONUS facilities to tactical edge nodes. The same security controls are enforced consistently because they’re built into the platform, not reimplemented per environment. This makes “authorize once, use many” operational: governance is repeatable and automatically enforced across your entire hybrid cloud and edge architecture.
Learn more about Rubix, Apollo, and Ontology on our platform pages. For complete information on Palantir’s security architecture and compliance controls, see our Palantir Government Web Services overview.
PFCS Forward Security Architecture & Operations
Secure Architecture
PFCS Forward delivers robust IL5 and IL6 authorized operational environments by combining the Rubix platform for container orchestration, hardened relational databases, and Palantir’s software suite (Foundry, Gotham, Apollo, and AIP) on customer-selected infrastructure. PFCS Forward environments are configured and maintained in strict accordance with DISA STIGs, DoD Cloud Computing SRG requirements, and industry standards. PFCS Forward implements a locked-down infrastructure which leverages automated compliance validation that ensures continuous alignment with security baselines.
Rubix clusters use hardened, minimal, or distroless container images and configuration-as-code to prevent drift and ensure declarative security. Rubix enforces multi-tenant isolation and secure network segmentation from enterprise data centers to tactical edge nodes. Horizontally expanding a PFCS Forward stack requires no updates to approved software lists — new hardware blocks simply scale compute, allowing mission owners to adapt rapidly without triggering new software accreditation cycles.
Access Control and Identity Management
PFCS Forward integrates with customer identity providers using Single Sign-On federation protocols like SAML and OIDC for both enterprise and tactical edge use cases. This enables customers to seamlessly leverage existing government hardware multi-factor authentication, like the Common Access Card (CAC). The customer’s authoritative identity provider governs all access — including user-facing applications and backend APIs — with comprehensive logging and auditability. The security boundary has undergone independent third-party penetration testing to validate resilience against advanced threats.
Security Operations Integration
PFCS Forward integrates directly with mission owner Security Information and Event Management (SIEM) systems for defensive cyber operations and incident response. PFCS Forward makes all host, application, and network logs available through authenticated endpoints, enabling customers to pull logs into their SIEM for real-time analysis, alerting, and retention. This gives customer Security Operations Centers (SOCs) and Cybersecurity Service Providers (CSSPs) full visibility into operational activity, audit trails, and security events while supporting agency-specific monitoring and incident response workflows.
Continuous Improvement
PFCS Forward is sustained through Palantir Apollo hubs, which provide automated patching, vulnerability remediation, configuration management, and secure software updates across distributed and disconnected environments. Apollo supports both opportunistic and air-gapped update workflows to keep mission systems current with DoW security requirements, even in Denied, Disrupted, Intermittent, and Limited (DDIL) communications scenarios.
Get Started with PFCS Forward
For US Government Customers
If you are interested in leveraging PFCS Forward to deploy Palantir or third-party software to on-premises or edge environments, please reach out to your Palantir team to discuss your deployment architecture, receive a detailed briefing on PFCS Forward’s authorization package, and understand how it integrates with your existing security controls.
Additional materials are available through DISA’s Cloud Service Catalog (listed as part of Palantir’s expanded IL5/IL6 Provisional Authorizations).
For Industry Partners: Software Vendors
Mission Manager offers government agencies and primes a scalable ecosystem platform to securely deploy, manage, and monitor third-party vendor applications in IL5 or IL6 environments. Third-party applications still require their own ATOs, but PFCS Forward’s fully managed and accredited Kubernetes environment significantly reduces the authorization burden. Vendors focus on application-level security controls rather than re-documenting infrastructure.
If you are an existing Mission Manager partner who wishes to understand how PFCS Forward may accelerate deployment to on-premises or edge environments, reach out to your Palantir point of contact. If you are a software company interested in deploying your software via Mission Manager, reach out to missionmanager@palantir.com and review our website at https://www.palantir.com/mission-manager/.
For Industry Partners: Hardware Vendors
We regularly partner with vendors to validate Rubix on their platforms, from enterprise-grade servers to ruggedized tactical systems. Validated hardware appears on our compatibility list, giving vendors a clear pathway into Palantir-enabled programs at the Department of War. This creates an ecosystem where hardware innovation can reach warfighters faster. Vendors benefit from streamlined integration into Palantir-enabled programs, and customers gain confidence in hardware selection.
If you are a hardware vendor interested in partnering to make your hardware baseline Rubix-compliant, reach out to missionmanager@palantir.com and review our documentation on our website at https://www.palantir.com/rubix/.
Moving at the Speed of Relevance
Authorization has been a rate-limiting step in delivering edge capabilities to warfighters for too long. PFCS Forward removes that constraint by making security governance inheritable — authorize the platform once, then deploy capabilities wherever the mission demands them.
The result is a defense technology ecosystem that can move at commercial speed while maintaining the security rigor required for national security missions. Software vendors can focus on building capabilities rather than re-documenting infrastructure. Hardware partners can innovate on form factors and performance knowing the software layer remains consistent. And most importantly, mission owners can get capabilities to warfighters in weeks rather than quarters.
PFCS Forward doesn’t eliminate the need for security — it systematizes it. The same hardened platform, the same access controls, the same compliance framework, from cloud to tactical edge. This type of “fully integrated system of systems” is what’s urgently needed by commanders and their warfighting requirements, US Army Lt. Gen. Paul T. Stanton, Defense Information Systems Agency director and Department of Defense Cyber Defense Command commander, asserted in his address at DISA’s Forecast to Industry 2025 event.
If you’re ready to accelerate capability delivery to forward-deployed forces, reach out to our team. Let’s get started.
Frequently Asked Questions
What is Palantir Federal Cloud Service (PFCS)?
Palantir Federal Cloud Service provides Department of War and Intelligence Community customers with secure, accredited access to Palantir’s software platforms across cloud, on-premises, and edge environments. With FedRAMP High, IL5, and IL6 authorizations, PFCS enables the most sensitive national security missions to leverage commercial innovation with confidence.
How does PFCS Forward differ from PFCS cloud?
PFCS provides IL5 and IL6 authorization for Palantir software in cloud environments. PFCS Forward extends that software baseline and authorization to on-premises and edge deployments with complete hardware flexibility — you choose the infrastructure that meets your mission requirements.
Do I need an ATO to use PFCS Forward?
Yes. PFCS Forward’s Provisional Authorization (PA) is the foundation for an Authorization to Operate (ATO). Each customer needs to grant their own ATO. PFCS Forward dramatically reduces the security implementation, documentation, and assessment work required for ATO. You inherit the Palantir software baseline and security controls; your ATO focuses on site-specific physical security, personnel security, and local technology integrations.
Does each site need its own ATO?
Not necessarily. A single Mission Owner ATO can cover multiple PFCS Forward deployments across different sites and data centers. For example, DISA’s Mission Owner ATO for the Joint Operational Environment (JOE) Palantir Platform covers numerous stacks and locations under one authorization. Instead of obtaining 10 separate ATOs for 10 deployments, you likely need just one.
DISA policy notes that for commercial cloud services:
The DOD CIO has determined that a two-step authorization process is required. The first step is to assess the CSP’s CSO to determine if it is secure enough to host DOD information and then preliminarily authorize or preapprove the CSO through the development of a DOD PA. This process is primarily for commercial CSOs. The second step is for the Mission Owner’s (i.e., the DOD customer of the CSO) AO to be aware of the risk to their specific information by the specific cloud use case and to accept that risk through an ATO.
— (Cloud Service Provider Security Requirements Guide, Version 1, Release 6, page 5)
The first step is performed by DISA and has already been completed for PFCS Forward. The second step is the responsibility of the customer using PFCS Forward.
How do software updates work in air-gapped environments?
Apollo supports multiple modalities for delivering software updates, including Palantir and third-party software, to disconnected environments. For air-gapped networks, Apollo can transfer software updates through a Cross Domain Solution (CDS), and maintains compatibility with many DoW and IC approved CDS providers in alignment with Raise the Bar (RTB) requirements. In degraded, intermittent, and limited network scenarios, Apollo employs opportunistic updates during connectivity windows, delta-based updates that minimize bandwidth, and local package caching at edge sites to enable continued software delivery. As a last resort, Apollo can always rely on approved physical media transfer to completely disconnected environments.
Can third-party applications leverage PFCS Forward?
Yes, through Mission Manager. Third-party applications must implement required security controls for ATO in their software, but they can inherit PFCS Forward’s PaaS authorization for on-premises and edge deployments. Vendors benefit from deploying via the accredited Apollo delivery pipelines. Your Palantir point of contact can provide the PFCS Forward Customer Responsibility Matrix (CRM) which explains this shared security responsibility model in detail.
I’m a hardware vendor. Can Rubix run on our hardware?
Rubix has baseline technical requirements for hardware compatibility. We regularly partner with hardware vendors to validate Rubix on their platforms and maintain a list of tested, compatible hardware to simplify adoption into existing or prospective Department of War programs. Our roadmap for expanding hardware compatibility is driven by DoW demand. Hardware vendors interested in validation should contact our Mission Manager team. Reach out to missionmanager@palantir.com for more information.
Introducing PFCS Forward was originally published in Palantir Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.