Appian Defense Cloud (ADC) Overview

What is Appian Defense Cloud?

Appian Defense Cloud (ADC) is a fully managed, Impact Level 5 (IL5) software-as-a-service offering that delivers the full Appian commercial platform in a Department of Defense (DoD)-compliant environment. ADC is hosted in AWS GovCloud and holds a DISA IL5 Provisional Authorization to Operate (PA), giving your organization a pre-authorized environment for building and deploying mission-critical applications.

ADC reduces the burden of achieving Authorization to Operate (ATO) by having Appian manage the IL5 security boundary, continuous monitoring, and infrastructure. Your organization can focus on application development, knowing that Appian has done the heavy lifting by pre-authorizing a significant portion of the system. ADC also provides day-one access to the Advanced Tier, which includes AI capabilities, Process HQ, data fabric, and Robotic Process Automation (RPA).

ADC architecture

ADC is built on STIG-compliant container infrastructure and runs on Appian on Kubernetes (AoK) in AWS GovCloud. The ADC accreditation boundary encompasses the Kubernetes infrastructure, Appian platform software, and network connectivity to the Department of Defense Information Network (DODIN). Your organization receives dedicated, single-tenant environments (development, test, and production) within isolated network boundaries.

Standard DODIN Enclave

The Standard DODIN Enclave is the default landing zone for DoW and Fourth Estate organizations operating at IL5. It provides the fastest, most cost-effective path to a DoD-authorized production environment by leveraging shared DISA and Appian-managed security infrastructure.

The Standard DODIN Enclave uses the following components:

• DISA BCAP: Routes all DODIN traffic through DISA's Boundary Cloud Access Point.
• Appian VDSS: Appian's Virtual Datacenter Security Stack (VDSS) enforces the security boundary and provides boundary protection functions, including firewall enforcement, intrusion detection and prevention, DNS filtering, and centralized security event logging.

Service-specific enclaves

For agencies that need to use their own BCAP and VDSS, or that require direct routing to private network resources, ADC also supports service-specific enclaves. A service-specific enclave routes traffic through an AWS Transit Gateway directly into your organization's network, giving your organization full control over all inbound and outbound traffic. Your organization is responsible for providing and configuring its own Secure Cloud Computing Architecture (SCCA).

ADC managed services

Appian provides the full Appian platform and all managed services required to meet DISA IL5 requirements.

ADC includes the following services:

• 24x7x365 platform and infrastructure monitoring and management.
• Fully managed platform updates and upgrades.
• Identity, Credential, and Access Management (ICAM) configuration for CAC and PIV authentication, completed by Appian during environment onboarding.
• SSL/TLS certificate management for your environments.
• Secure initial credential delivery via DoD SAFE during environment provisioning.
• S3 log streaming to enable cyber monitoring teams to ingest application logs from Appian environments.

All user traffic in ADC routes through an authorized DISA BCAP to reach the DODIN. ADC environments do not have public internet ingress. Basic username and password authentication is not permitted in DoD production environments; all users must authenticate using CAC or PIV credentials through your organization's configured ICAM provider.

ADC does not provide email or SMTP services. Instead, your organization must integrate ADC with your existing email provider.

ADC's DISA IL5 PA provides substantial ATO inheritance, meaning your organization only needs to account for the application layer running in Appian and any system interconnections outside the ADC boundary. Your organization is responsible for configuring your agency-specific eMASS records and securing an Interim Authority to Test (IATT) or Interim Authority to Build (IATB) before system connections are established.

ADC feature availability

ADC provides near-full parity with the Appian Cloud platform.

The following features are not available in ADC:

• Portals: Not supported.
• Enhanced Business Continuity (EBC): Not supported.
• Private Connectivity Services: VPNs and PrivateLink are not supported.
• Email/SMTP: Appian does not provide email service in ADC. Your organtheization must integrate with your own email provider.
• Enhanced Data Pipeline (EDP): Not supported in the Standard DODIN Enclave due to DODIN port and protocol restrictions. EDP is supported in service-specific enclaves.
• Non-Appian workloads: ADC does not support hosting third-party services, custom code, or non-MariaDB Appian data sources.
• IL6 workloads: ADC is an IL5 environment and supports Controlled Unclassified Information (CUI) and National Security System (NSS) workloads on NIPRNet only. If your organization requires Impact Level 6 (IL6) or JWICS workloads, use a self-managed deployment.

Support and questions

If your organization needs assistance, contact our dedicated Appian Defense Cloud support team.

For more information about ADC, email adc@appian.com.

Feedback