What Are the FedRAMP Baselines (Low, Moderate, High)?

Picking the wrong FedRAMP baseline can add months of wasted work to your authorization.

FedRAMP (Federal Risk and Authorization Management Program) defines three baselines: Low, Moderate, and High.

Each baseline is a list of security controls a cloud service must implement and prove.

NIST (National Institute of Standards and Technology) publishes the federal security control catalog in SP 800-53 (Special Publication 800-53).

FedRAMP builds on that catalog, tailoring the NIST baselines from SP 800-53B for cloud services.

How the level is chosen

The level comes from FIPS 199 (Federal Information Processing Standard 199), the federal categorization standard.

You rate your system on three objectives: confidentiality, integrity, and availability.

Confidentiality means keeping data away from people who should not see it.

Integrity means stopping data from being changed or destroyed by mistake or attack.

Availability means users can reach the system when they need it.

For each objective, you ask what a breach would cost: limited, serious, or severe and catastrophic harm.

Low means a limited adverse effect on operations, assets, or individuals.

Moderate means a serious adverse effect.

High means a severe or catastrophic adverse effect.

Your overall level is the highest of the three, never the average (FedRAMP's authorization considerations).

A service with High confidentiality but Low availability is still High overall.

The federal agency customer makes the final call on your impact level, so confirm it early.

The three baselines

FedRAMP's Rev 5 baselines carry about 156, 323, and 410 controls for Low, Moderate, and High.

FedRAMP adds its own controls and parameter values to the NIST SP 800-53B baselines, so the counts differ from NIST's (NIST on SP 800-53B).

Low

Low fits systems where a breach would cause limited harm: public websites, open data portals, and low-risk services.

Moderate

Moderate fits systems where a breach would cause serious harm.

These include systems handling CUI (Controlled Unclassified Information) or PII (personally identifiable information).

Nearly 80 percent of FedRAMP authorized services use the Moderate baseline (FedRAMP's authorization considerations).

If your service will touch federal agency data you cannot clearly call low risk, plan for Moderate.

High

High fits systems where a breach could be severe or catastrophic: law enforcement, emergency services, financial systems, and health systems.

FedRAMP created the High baseline for the federal government's most sensitive unclassified data in the cloud.

Expect far more evidence, stricter parameters, and deeper assessment than at Moderate.

The fourth option: LI-SaaS

LI-SaaS (Low Impact Software as a Service) is a lighter version of the Low baseline.

It covers simple SaaS (Software as a Service) apps that hold no PII beyond login credentials.

FedRAMP calls it the Tailored baseline, and it lowers the number of controls needing independent testing and verification (FedRAMP's authorization considerations).

Documentation is consolidated, so the path is faster than a full Low authorization.

To qualify, your service must meet every one of these conditions:

• It is fully operational, not still in development.
• It is a true SaaS offering under NIST SP 800-145 (The NIST Definition of Cloud Computing).
• It holds no PII beyond what login needs, meaning just a username, password, and email address.
• It categorizes as FIPS 199 Low.
• It runs on FedRAMP-authorized infrastructure or supplies its own within the authorization boundary.

Watch for this trap: a Moderate SaaS offering is not eligible for LI-SaaS.

LI-SaaS is Low impact SaaS only, with no exceptions.

What to do with this

Work through these steps before you commit to a baseline:

1. List every data type your service will store, process, or transmit.
2. Rate confidentiality, integrity, and availability for each data type.
3. Take the highest rating across all three as your overall level.
4. If every rating is Low and your app is a simple SaaS service, check LI-SaaS eligibility.
5. Confirm your level with your federal agency customer before you build your plan.

Next step

Every baseline demands evidence for each control you claim, and that evidence takes real work to gather.

PolicyCortex is not FedRAMP authorized; it is a commercial tool for collecting NIST control evidence.

It reads live Azure configuration through 33 collectors and maps the results against NIST SP 800-53 and NIST SP 800-171.

It turns that evidence into your authorization package: SSP, SAR, and POA&M documents, with re-verification after remediation.

• SSP (System Security Plan): the blueprint of your implemented controls.
• SAR (Security Assessment Report): the assessor's documented results.
• POA&M (Plan of Action and Milestones): your corrective action plan.

See how it works at policycortex.com.

Sources

• FedRAMP authorization considerations: impact levels, baselines, and deployment models (FedRAMP documentation: Low, Moderate, and High definitions, LI-SaaS eligibility, agency customer deciding the level)
• NIST SP 800-53B announcement (NIST: three security control baselines for low, moderate, and high impact systems)