FedRAMP Impact Levels and Baselines: Low, Moderate, High and LI-SaaS

FedRAMP impact levels decide how many security controls a cloud service must implement to be authorized for use by US federal agencies. FedRAMP uses three impact levels, Low, Moderate and High, plus a tailored LI-SaaS baseline for low-impact software. Each level has a baseline of NIST SP 800-53 controls. The more harm a breach could cause, the higher the level and the more controls you need. This guide explains how the levels work, what each baseline covers, and how to choose the right one.

Related guides: FedRAMP authorization checklist · FedRAMP for startups · Best FedRAMP compliance software · FedRAMP-compatible trust centers

Key takeaways

• Impact levels come from FIPS 199, which rates the potential impact of a loss of confidentiality, integrity or availability.
• Rev 5 baselines contain roughly 156 controls (Low), 323 (Moderate) and 410 (High), counting control enhancements.
• Moderate is the most common level, covering most federal cloud services.
• LI-SaaS offers a lighter path for low-risk SaaS that does not store sensitive personal data.

---

How FedRAMP impact levels are set

FIPS 199 asks what would happen if the data in your system lost confidentiality, integrity or availability. Each is rated low, moderate or high impact, and the system's overall level is the highest of the three, the "high water mark". For example, a system where a breach of confidentiality would have a serious adverse effect is Moderate, even if integrity and availability are only low.

Impact	Meaning of a loss
Low	Limited adverse effect on operations, assets or individuals
Moderate	Serious adverse effect, such as significant damage, financial loss or harm to individuals
High	Severe or catastrophic effect, such as loss of life or major financial loss

FedRAMP baselines compared

	LI-SaaS	Low	Moderate	High
Typical data	Low-risk, no sensitive personal data beyond basic login details	Public or low-impact data	Controlled unclassified information, most agency data, PII	Law enforcement, emergency services, financial and health systems where a breach could be severe
Control baseline	Tailored Low subset, many controls attested rather than tested	About 156 controls	About 323 controls	About 410 controls
Share of authorizations	Small	Small	The large majority	Growing, especially for large providers
Effort and cost	Lowest	Low	High	Highest
Examples	Collaboration or survey tools with minimal data	Public websites, low-risk tools	Most SaaS, PaaS and IaaS used by agencies	Critical systems at large agencies

Control counts are approximate and can change as FedRAMP updates its baselines, so check the current FedRAMP documents.

FedRAMP LI-SaaS

The Low Impact SaaS (LI-SaaS) baseline, sometimes called FedRAMP Tailored, is for SaaS applications that are low risk and do not store personal data beyond what is needed for login, such as names, usernames and emails. Many controls are attested by the provider rather than fully tested by an assessor, which reduces cost and time. Agencies must confirm the service meets the LI-SaaS criteria.

FedRAMP Moderate

Moderate is the default for most cloud services agencies use, because most agency data, including much PII, would cause serious harm if exposed. It requires a full System Security Plan, assessment by a FedRAMP-recognized Third Party Assessment Organization (3PAO), and continuous monitoring with monthly vulnerability scanning and reporting.

FedRAMP High

High applies to systems where a breach could have severe or catastrophic effects, such as law enforcement, emergency services, health and financial systems. It adds more controls and stricter enhancements, such as stronger auditing, incident response and supply chain protections.

FedRAMP and DoD impact levels

The Department of Defense uses its own Cloud Computing Security Requirements Guide with Impact Levels 2, 4, 5 and 6. IL2 generally aligns with FedRAMP Moderate, while IL4 and IL5 add DoD-specific controls for controlled unclassified and mission-critical information. IL6 covers classified information. Defense contractors may also need CMMC, which is separate.

How to choose your FedRAMP level

1. Identify the data agency customers will put in your service.
2. Run a FIPS 199 categorization for confidentiality, integrity and availability.
3. Talk to your sponsoring agency. It will usually confirm the level it needs.
4. Check LI-SaaS eligibility if your service is low risk with minimal personal data.
5. Consider future customers. If you expect to sell to agencies that need Moderate, building to Moderate from the start avoids a second effort.

FedRAMP 20x

FedRAMP is modernizing its process through FedRAMP 20x, which aims to make authorization faster through automation, machine-readable evidence and key security indicators rather than lengthy documents. It is being introduced in phases, starting with lower impact levels. Check current FedRAMP guidance before choosing your path.

The FedRAMP authorization process at a glance

1. Find an agency sponsor that wants to use your service.
2. Categorize the system with FIPS 199 and confirm the baseline.
3. Prepare documentation, led by the System Security Plan, plus policies, an incident response plan, a configuration management plan and a continuous monitoring strategy.
4. Implement the controls and close gaps, often after a readiness assessment.
5. Full security assessment by an accredited 3PAO, producing a Security Assessment Report.
6. Agency review and authorization, leading to an Authority to Operate and listing in the FedRAMP Marketplace.
7. Continuous monitoring: monthly vulnerability scans, POA&M updates, annual assessments and significant change requests.

What makes Moderate harder than Low

Area	Low	Moderate
Number of controls	About 156	About 323
Multi-factor authentication	Required for users	Stronger requirements, including for privileged and network access
Audit logging	Basic logging	More events, central review and correlation
Incident response	Basic plan and reporting	Testing, coordination and more detailed handling
Configuration management	Baselines	Baselines plus stricter change control and least functionality
Contingency planning	Basic backups	Tested plans and alternate processing considerations

Cost and timeline by level

Effort rises sharply with each level. LI-SaaS and Low authorizations can take months, while Moderate and High commonly take a year or more from start to authorization, including documentation, remediation, 3PAO assessment and agency review. Costs include 3PAO fees, remediation, tooling, staff time and continuous monitoring every year after authorization. Reusing an existing SOC 2 or ISO 27001 program shortens the work, since many controls overlap with NIST SP 800-53.

How SecureSlate helps

SecureSlate maps your controls to FedRAMP baselines and NIST SP 800-53, reusing work from SOC 2 and ISO 27001, tracks continuous monitoring tasks and POA&Ms, and keeps evidence organized for your 3PAO and agency.

FAQ

What are the FedRAMP impact levels?

Low, Moderate and High, based on FIPS 199, plus the tailored LI-SaaS baseline for low-impact SaaS.

Which FedRAMP level is most common?

Moderate. Most cloud services used by federal agencies are authorized at the Moderate baseline.

How many controls are in FedRAMP Moderate?

Roughly 323 controls and enhancements under the Rev 5 baseline. Check the current FedRAMP baseline for the exact count.

Can we move from Low to Moderate later?

Yes, but it requires implementing and assessing the additional controls. Planning for the higher level early saves rework.

Is FedRAMP High required for health data?

Not always. Many systems with health data are Moderate. The FIPS 199 categorization and the agency decide.

---

What is a 3PAO?

A Third Party Assessment Organization accredited to assess cloud services against FedRAMP requirements and produce the Security Assessment Report.

Does FedRAMP apply to state and local government?

Not directly. FedRAMP is for federal agencies. Many states use StateRAMP, now known as GovRAMP, which follows a similar model based on NIST SP 800-53.

Do we need FedRAMP to sell to federal agencies?

Cloud services that hold federal information generally need FedRAMP authorization at the appropriate level. Agencies may use limited exceptions, so confirm with your agency customer.

What is continuous monitoring in FedRAMP?

The ongoing work after authorization: monthly vulnerability scans, POA&M updates, annual assessments by a 3PAO, incident reporting and approval for significant changes.

What is the FedRAMP Marketplace?

A public listing of cloud services that are FedRAMP authorized, in process or ready, which agencies use to find and reuse existing authorizations.

Does SOC 2 help with FedRAMP?

Yes, as a starting point. Many SOC 2 controls overlap with NIST SP 800-53, but FedRAMP adds many more specific controls, documentation and continuous monitoring requirements.

Disclaimer (legal note)

General information only, not legal, audit, or attestation advice. Requirements depend on your contracts, system boundary, and assessor guidance.