If you're a cloud service provider working toward FedRAMP 20X authorization, you've likely run into the CDS-CSO-SVC requirement: publish a complete list of every FedRAMP-authorized service you offer, along with a security category for each one. That category isn't something you invent on your own — it comes from FIPS 199, the federal standard that determines how much potential impact a security incident could have on your system.
Getting this categorization right matters more than it might seem. It shapes how rigorously your system is assessed and ultimately how fast you move through authorization. This guide breaks down exactly what FIPS 199 measures, how to calculate a Low, Moderate, or High rating, and walks through a full worked example so you can apply the same process to your own services.
What Is FIPS 199?
FIPS 199 (Federal Information Processing Standard 199) is a NIST standard that tells system owners and developers how to categorize the potential impact to a system if its data were exposed, altered, or made unavailable. In practice, it's the tool you use to answer the question: "How bad would it be if something went wrong here?"
Under FedRAMP 20X's CDS-CSO-SVC requirement, every individual service inside your FedRAMP Minimum Assessment Scope (MAS) needs its own FIPS 199 categorization, not just the system as a whole.
The Three Pillars of FIPS 199
FIPS 199 evaluates risk across three types of harm — often called the CIA triad:
Confidentiality — What happens if unauthorized people can see your data
Integrity — What happens if your data is altered, corrupted, or tampered with
Availability — What happens if your system is down or inaccessible
Each of these three areas is independently rated Low, Moderate, or High — and each rating tells a different part of the risk story.
How Your Overall Security Category Is Calculated
Your final security category isn't an average of the three ratings — it's the highest one. NIST calls this the "high-water mark" rule: if any single pillar is rated High, the overall rating is High, even if the other two are lower.
For example, a system rated Confidentiality = Moderate, Integrity = High, Availability = Low has an overall rating of High — the highest of the three.
This rule applies at two levels:
- System level — the security category of your platform as a whole
- Service level — the security category of each individual service in your FedRAMP Minimum Assessment Scope, per CDS-CSO-SVC
Low vs. Moderate vs. High: What Each Rating Means
Use these FIPS 199 definitions to determine whether your system — or any service within it — is Low, Moderate, or High:
| Rating | Potential Consequences | Typical Data It Applies To |
|---|---|---|
| LOW | Limited harm with minimal disruption to operations. | Non-sensitive or low-risk data. |
| MODERATE | Meaningful harm and noticeable operational disruption. | Sensitive business data or personal information. |
| HIGH | Severe damage — major financial loss, legal exposure, or long-term harm to trust and operations. | High-risk, regulated, or mission-critical data. |
Example: How Meridian Cloud Solutions Categorizes Its FedRAMP Services
Here's how this plays out in practice. Meridian Cloud Solutions (a fictitious provider) offers the Meridian Cloud Platform (MCP), a FedRAMP-authorized system built from several distinct services. Under CDS-CSO-SVC, Meridian has to publish a security category for the platform overall and for every service inside its FedRAMP Minimum Assessment Scope.
Step 1: Rate the System as a Whole
| Confidentiality | Integrity | Availability | Overall System Rating |
|---|---|---|---|
| High | High | Moderate | HIGH |
Step 2: Rate Every Service in Scope
| Service | Confidentiality | Integrity | Availability | Overall Category |
|---|---|---|---|---|
| Identity & Access Management (IAM) API | High | High | Moderate | HIGH |
| Encrypted Object Storage | Moderate | Moderate | Moderate | MODERATE |
| Audit Log & Monitoring Service | Low | Moderate | Low | MODERATE |
| Customer Support Portal | Moderate | Low | Low | MODERATE |
Step 3: Understand What's Driving the Rating
Notice that three of Meridian's four services land at Moderate — but the platform's overall rating is High. That's because the Identity & Access Management (IAM) API handles authentication credentials and session tokens. If that data were exposed or tampered with, an attacker could impersonate any customer across the entire platform — so Confidentiality and Integrity are both rated High for that one service.
Because FIPS 199 always applies the highest rating across every component, that single service pulls Meridian's overall system rating up to High, even though most of the platform sits at Moderate. This is exactly the kind of detail CDS-CSO-SVC is designed to surface: an agency reviewing Meridian's authorization needs to see not just the system-wide rating, but which specific service is driving it.