The Federal Risk and Authorization Management Program (FedRAMP®) defines three security baselines — Low, Moderate, and High — based on how sensitive a system’s data is and how disruptive it would be if the system were compromised.
Each baseline includes a specific set of security and privacy controls from the National Institute of Standards and Technology (NIST) Special Publication 800–53, Revision 5. NIST 800–53 is the U.S. government’s authoritative source for evaluating the security posture of cloud systems.
How many FedRAMP controls are there?
The number of required controls depends on your baseline:
How FIPS 199 determines your FedRAMP level
FedRAMP uses the Federal Information Processing Standards (FIPS) Publication 199 to determine which baseline a system must meet. FIPS 199 assesses impact levels across three key areas: confidentiality, integrity, and availability.
FIPS 199 uses the “high-water mark” method. That means your overall baseline is determined by the highest impact level across confidentiality, integrity, and availability. If even one area is rated High, your system must meet the FedRAMP High baseline.
Choosing the correct FedRAMP baseline early is critical. It helps you scope the right level of effort, estimate timelines more accurately, and avoid costly rework later.
If you don’t feel like reading FIPS 199, you can get a general sense of what security baseline most likely applies to your cloud service offering by answering three core questions:
1. What happens if your system goes down?
- Low: Minor inconvenience — users can wait or find workarounds
- Moderate: Significant disruption — operations are impaired, but the organization can still function
- High: Mission-critical failure — the organization cannot perform essential functions, or safety could be affected
2. What’s the impact if sensitive data is leaked?
- Low: Limited harm — some embarrassment, minor financial loss, or exposure of routine information
- Moderate: Serious consequences — financial loss, competitive harm, or privacy violations
- High: Severe damage — reputational fallout, legal exposure, or risk to public safety
3. What if someone maliciously alters your data?
- Low: Minor impact — issues are easily detected and corrected
- Moderate: Significant problems — business decisions are affected, or regulatory issues arise
- High: Severe consequences — mission failure, safety risks, or major financial loss
FedRAMP Moderate vs. High: Which baseline do you need?
Most cloud products serving the federal market align with the FedRAMP Moderate baseline. Moderate covers the majority of government use cases where data is sensitive but not tied to national security or life-safety systems.
FedRAMP High is reserved for systems handling the most sensitive unclassified data — think law enforcement, emergency services, healthcare, and financial systems where a breach could directly endanger public safety. If your system supports any of these missions, expect to meet the High baseline.
If you’re unsure, start with the three questions above. They’ll give you a strong directional answer, and your 3PAO can help you confirm during the formal assessment process.
Frequently Asked Questions
What’s the difference between FedRAMP Moderate and High?
Moderate covers 323 controls and applies to most government cloud use cases. High requires 410 controls and is reserved for systems where a breach could cause severe harm, including risk to public safety or critical operations.
What are the FedRAMP High requirements?
FedRAMP High requires implementing all 410 security controls from NIST 800–53. These include everything in the Moderate baseline plus additional controls around incident response, access restrictions, and system resilience for high-impact environments.
How do I know which FedRAMP level I need?
Your baseline is determined by a FIPS 199 assessment, which evaluates the potential impact of a security breach across confidentiality, integrity, and availability. The highest rating across those three areas sets your baseline.