FedRAMP Impact Levels: Low, Moderate, High (and LI-SaaS)

FedRAMP authorizations come at impact levels that determine how many controls a system must implement. The level follows from the sensitivity of the data the service will hold.

The levels

• —Low — limited adverse effect if data is compromised; the smallest control baseline.
• —Moderate — serious adverse effect; the most common level, and the bar for most CUI-handling SaaS.
• —High — severe or catastrophic effect; used for the most sensitive unclassified data, such as law enforcement or emergency systems.

LI-SaaS (Low Impact SaaS)

A streamlined path for low-impact software-as-a-service that handles minimal data (often just login information). It uses a tailored, smaller set of controls and a lighter package — a good fit for simple tools.

Choosing your level

Categorize the data the service will store and process (see FIPS 199), then pick the level that matches the highest impact. Authorizing higher than necessary multiplies your control count and cost; authorizing too low risks rejection. Match the level to the data, deliberately.