FedRAMP baselines explained: R4, R5, Low, Moderate, High, and LI-SaaS

FedRAMP R4

Cloud service providers maintaining existing FedRAMP authorisations issued under NIST SP 800-53 Revision 4, and those currently executing the R4-to-R5 transition. R4 as a standalone designation is a maintenance-only status -- no new R4 packages are being accepted. Federal agency CISOs managing R4-authorised services and planning transition timelines.

Treating significant changes as minor to avoid the notification and re-assessment process. Architecture changes, boundary expansions, and new subcontractor integrations frequently happen without FedRAMP impact assessments. The 3PAO discovers these undocumented changes during annual assessment and the resulting findings -- often systemic -- require months of remediation.

FedRAMP R4 is NIST RMF operationalised for multi-tenant cloud. The core deliverables are the System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), and Plan of Action and Milestones (POA&M). The assessment requires an A2LA-accredited 3PAO. Post-authorisation, monthly ConMon deliverables include vulnerability scans, POA&M updates, and inventory changes. Annual deliverables include a full 3PAO reassessment. Significant change notifications are required before major system modifications and can trigger partial re-assessment.

JAB P-ATOs are overseen by the Joint Authorization Board (DoD, DHS, GSA). Agency ATOs are maintained by the sponsoring agency''s authorising official. Failure to meet ConMon SLAs -- particularly the 30-day remediation window for High findings -- can trigger agency review of ATO status and in serious cases, suspension. The FedRAMP programme does not itself have regulatory enforcement authority; consequences flow through the agency contract relationship.

FedRAMP R4 is the parent framework for all R4 baseline variants (Low, Moderate, High, LI-SaaS). It establishes the boundary-first philosophy, the authorisation pathway structure (JAB vs Agency ATO), the 3PAO requirement, and the ConMon model that all four R4 baselines implement at different intensities. R5 is its successor; R4 and R5 ATOs coexist during the transition period but are not interchangeable.

FedRAMP R4 (Low)

Cloud service providers operating systems where all three FIPS 199 objectives -- confidentiality, integrity, and availability -- are rated LOW. Practically: public websites, open data platforms, collaboration tools handling no sensitive federal data, and systems whose unavailability would cause only limited mission disruption. Federal agency CISOs evaluating whether a procurement qualifies for Low-baseline treatment.

Boundary over-scoping. CSPs include corporate IT systems, third-party SaaS tools, and external services in the Low-baseline boundary that do not need to be there. Each component in scope adds assessment surface and ConMon obligation. A well-scoped Low boundary covers only what stores, processes, or transmits federal data and the security controls protecting it. Overly broad boundaries are the primary cause of Low-baseline assessments taking longer and costing more than necessary.

Approximately 125 controls across all NIST 800-53 control families present in higher baselines, at reduced stringency. IA-2 (identification and authentication) requires MFA for privileged accounts over network access. AU-2/AU-3 require audit logging of defined event categories. SI-2 (flaw remediation) requires patch management with defined SLAs. Monthly ConMon: vulnerability scans, POA&M updates. Vulnerability remediation SLAs are identical to Moderate and High: Critical 15 days, High 30 days, Moderate 90 days. The SLAs do not scale with baseline level.

Agency ATOs are the typical pathway for Low-baseline systems; JAB P-ATOs at Low are rare. Agency authorising officials hold the risk acceptance authority. An active Low ATO can be reused by other agencies via the FedRAMP Marketplace without re-assessment -- the consuming agency reviews the existing package and issues a local ATO. This reuse mechanism is structurally underused: agencies routinely re-assess services that already have Low ATOs rather than leveraging existing packages.

Low is the foundational tier. All Moderate and High controls are a superset of Low. LI-SaaS is a subset of Low for eligible SaaS systems. A CSP transitioning from LI-SaaS to Low because their federal data scope expanded faces a genuine implementation gap -- 89 additional controls beyond LI-SaaS''s 36, many with Moderate-equivalent stringency for some parameters.

FedRAMP R4 (Moderate)

The majority of federal cloud services -- any system where at least one information type is categorised MODERATE under FIPS 199. This includes systems processing Controlled Unclassified Information (CUI), personally identifiable information subject to the Privacy Act, financial transaction data, export-controlled technical data, and systems whose unavailability would cause serious disruption to agency mission functions.

SSP vagueness that blocks 3PAO assessment. The single largest cause of Moderate authorisation delays is SSPs that describe controls with generic language -- ''the system implements access controls in accordance with policy'' -- rather than specifying the technology, configuration, and process that delivers each control. A 3PAO cannot design a test for a vague claim. SSPs written at this level of abstraction require multiple remediation cycles before assessment can begin, adding months to the timeline.

Approximately 325 controls. The five most demanding families by implementation effort are Access Control (AC, 25 controls), System and Communications Protection (SC, 39 controls), Configuration Management (CM, 11 controls), Audit and Accountability (AU, 12 controls), and Contingency Planning (CP, 10 controls). IA-2 at Moderate extends MFA to all user accounts, not just privileged ones. CP-4 requires annual contingency plan tests that include actual recovery operations -- tabletop exercises alone are insufficient. Penetration testing must be performed by the accredited 3PAO annually, following FedRAMP Penetration Testing Guidance.

The commercially dominant FedRAMP tier. Most federal contracts for cloud services specify Moderate as the minimum. A JAB P-ATO at Moderate signals broad federal reusability and typically accelerates agency adoption. Agency ATOs are faster to obtain but may require additional agency-specific reviews for each new customer. Preparation costs typically range from $500,000 to $2 million. The investment is justified by an addressable market spanning the entire federal civilian agency landscape.

Moderate is the engine of the FedRAMP programme by volume. It is a superset of Low and a subset of High. R4 Moderate and R5 Moderate use different NIST 800-53 control identifiers and R5 adds 12 SR controls and 8 PT controls with no R4 equivalent. An existing R4 Moderate ATO does not satisfy R5 Moderate requirements without transition.

FedRAMP R4 (High)

Cloud systems supporting the most sensitive unclassified federal missions: law enforcement databases, emergency response platforms, sensitive healthcare records, financial transaction processing, and intelligence community unclassified workloads. Authorising officials at DHS, DOJ, HHS, Treasury, DoD components. 3PAOs with documented High-baseline assessment experience -- not all 3PAOs accept High engagements.

Underestimating the personnel security requirements. PS-3 at High requires background investigations for personnel with privileged access to the system. These investigations take 3-6 months and must be completed before personnel have unsupervised access. CSPs that begin High-baseline preparation without initiating personnel investigations immediately face a 3-6 month delay that no technical preparation can accelerate.

Approximately 421 controls -- 96 more than Moderate -- with significantly tightened parameter values throughout. AC-2 account reviews quarterly (not annually at Moderate). IA-2 requires replay-resistant MFA for all access. IA-3 requires device authentication, not just user authentication. SI-4 (information system monitoring) requires host-based intrusion detection, network behaviour analysis, and integration with CISA''s CDM programme where applicable. SC-12 cryptographic key management effectively mandates HSM use. CP-4 annual contingency tests must be full system recovery exercises, not tabletops. ConMon at High requires a SOC capability -- internal, managed, or hybrid.

High-baseline assessments typically cost significantly more than Moderate and take 6-12 months. The market is smaller by volume but higher in contract value. A High ATO grants access to the most sensitive federal workloads and positions CSPs for DoD IL4/IL5 pursuit. FedRAMP High was introduced in 2016 -- before it existed, agencies with high-impact missions could not move critical systems to cloud platforms. Non-compliance or ConMon failure at High carries greater scrutiny and faster agency response than at lower baselines.

High is the apex tier of FedRAMP. It is a superset of both Low and Moderate. The approximately 80% overlap between FedRAMP R4 High and DoD IL4/IL5 makes it a strategic stepping stone for CSPs targeting the DoD market. R5 High adds supply chain controls (SR family) and adversarial simulation requirements (CA-8) that R4 High does not contain.

FedRAMP R4 (LI-SaaS)

SaaS vendors -- exclusively SaaS, not IaaS or PaaS -- offering low-risk productivity, collaboration, or utility tools where the system stores no federal operational data beyond identity metadata and service usage logs. Video conferencing platforms that do not record or retain content, project management tools used only for non-sensitive task tracking, and survey platforms that do not collect sensitive response data are archetypal LI-SaaS candidates.

Approximately 36 controls, the lowest count in the FedRAMP programme. The reduced count is only sustainable because of aggressive inherited control use -- LI-SaaS systems must be built on FedRAMP-authorised IaaS or PaaS, inheriting physical security, environmental controls, and infrastructure security from the underlying platform. A real 3PAO assessment is still required: SAP, SAR, and POA&M. Assessment timelines are 4-8 weeks rather than months. Costs typically range from $75,000 to $200,000 total, including 3PAO fees and internal preparation.

LI-SaaS authorisations are issued by individual agencies as agency ATOs, not by the JAB. Each agency reviews the CSP''s package and issues their own ATO, potentially with agency-specific additional requirements layered on top. A CSP may hold simultaneous ATOs from multiple agencies for the same LI-SaaS system. ConMon obligations are lighter -- monthly scans and POA&M updates, annual 3PAO assessment -- but vulnerability remediation SLAs are identical to all other baselines.

LI-SaaS is a tailored subset of Low, not an independent tier. The eligibility criteria are strict and the failure mode is data scope creep: once a federal agency stores operational content in a LI-SaaS system, the system is out of scope and requires a full Low or higher authorisation. LI-SaaS documentation artefacts are different enough from Low that a subsequent upgrade to Low requires essentially a fresh SSP -- the LI-SaaS package is not a stepping stone in terms of reusable documentation.

FedRAMP R5

All cloud service providers initiating new FedRAMP authorisations (R5 is now mandatory for new packages). CSPs with existing R4 ATOs executing the structured transition. Federal agency CISOs, authorising officials, 3PAOs, and acquisition teams who work with cloud services under the current FedRAMP standard.

Treating the R4-to-R5 transition as a documentation update rather than a genuine security programme change. The SR family controls require real operational implementations that take months to build: SBOM generation in CI/CD pipelines, signed container images, vendor assessment programmes, supply chain incident response procedures. CSPs that start documentation without standing up these operational capabilities fail 3PAO assessments for SR controls.

R5 is the base framework for all current FedRAMP activity. Its most significant additions over R4 are the Supply Chain Risk Management (SR) family -- 12 new controls with no R4 equivalent -- and the PII Processing and Transparency (PT) family -- 8 controls integrated throughout the catalogue rather than isolated in an appendix. R5 also restructured several control families, updated parameter values to address current threats, and explicitly addressed cloud-native architectures (containers, microservices, serverless) in ways that R4 did not. Zero Trust Architecture principles are reflected throughout the enhanced IA, AC, SC, and monitoring controls.

No new R4 packages are accepted. Existing R4 ATOs remain valid during the transition period, but agencies are updating procurement requirements to specify R5. CSPs who complete R5 transition proactively are better positioned than those who wait until agency requirements force the transition. The FedRAMP Authorization Act of 2022 formalised the programme''s legislative foundation.

R5 is the current branch of the programme. All new activity -- new authorisations, new control baselines, new 3PAO assessment guidance -- occurs on R5. R4 and R5 coexist during transition but are moving toward R5 as the sole active standard. The cross-framework insight described later in this article is only visible when the R4 and R5 branches are examined together.

FedRAMP R5 (Low)

Cloud service providers seeking new FedRAMP Low authorisations under current requirements, and those with existing R4 Low ATOs executing mandatory transition. Federal agency compliance teams evaluating R5 Low packages for agency ATO issuance.

Configuration drift between assessment and ongoing operations. R5 Low explicitly requires continuous configuration monitoring, not point-in-time hardening. Systems that pass assessment with clean CM-6 findings then accumulate misconfigurations through normal operational changes. Monthly vulnerability scans catch vulnerable software but not configuration drift -- a separate automated configuration compliance tool is needed and frequently missing from Low-baseline ConMon programmes.

Approximately 125 controls, updated to R5 identifiers and parameter values. The R5 additions specific to Low baseline are: SR-1 (Supply Chain Risk Management Policy -- a documented policy, not a full programme), SR-2 (Supply Chain Risk Management Plan at a basic, foundational level), and PT-1 (Privacy Policy, if PII is processed). Configuration management requirements under CM-6 tighten expectations around ongoing drift detection -- the system must be monitored for configuration changes against the documented baseline, not just hardened at assessment time. The basic SR requirements reflect a recognition that supply chain attacks do not respect impact level boundaries.

Agency ATOs are the primary pathway. ConMon obligations are identical in structure to R4 Low: monthly vulnerability scans and POA&M updates, annual 3PAO assessment. Remediation SLAs unchanged. The R5 Low transition from R4 is lighter than higher-baseline transitions -- most of the work is documentation updates plus SR-1 and SR-2 policy creation.

R5 Low is the current version of the entry tier. It adds supply chain and privacy baseline requirements absent from R4 Low, establishing a floor that applies universally regardless of impact level. LI-SaaS R5 is a subset of R5 Low with the same eligibility criteria as R4 LI-SaaS.

FedRAMP R5 (Moderate)

The majority of active federal cloud procurement. Any system with a MODERATE FIPS 199 categorisation must pursue R5 Moderate for new authorisations. This is the most commercially significant FedRAMP tier -- most federal contracts for cloud services specify Moderate as the minimum requirement. Also applicable to the large installed base of R4 Moderate ATOs executing mandatory transition.

SR family assessment failures caused by policy-only implementations. SR-4 (Provenance) requires an SBOM and the process that generates and maintains it -- 3PAOs ask to see the SBOM file and run queries against it. SR-6 (Supplier Assessments) requires documented evidence of periodic supplier security reviews -- SOC 2 Type II report reviews with sign-off are typically acceptable. CSPs that produce policy documents for SR controls without standing up the underlying operational processes fail assessment at the SR section.

Approximately 323 controls. The major R5 additions over R4 Moderate are the complete SR family (all 12 controls, not just SR-1/SR-2 as at Low), the full PT family (8 controls where PII is processed), and updated IA controls requiring phishing-resistant MFA -- FIDO2/WebAuthn or PIV/CAC -- for privileged access. SMS-based OTP is explicitly no longer sufficient at Moderate. SI-4 monitoring now requires telemetry sharing with agency security monitoring infrastructure, not just internal monitoring. AU-2 audit event requirements were updated to include container lifecycle events, API gateway logs, and identity provider authentication events reflecting cloud-native architectures.

The transition from R4 Moderate to R5 typically requires 9-15 months elapsed time and costs roughly 30-50% of the original authorisation effort. Agency procurement requirements are being updated to specify R5. CSPs who delay transition will face increasing procurement barriers as agencies move to R5-only requirements. CMMC Level 2 shares approximately 70-80% control overlap with R5 Moderate -- running both as separate compliance programmes duplicates most of the effort.

R5 Moderate is the current commercial standard and the de facto entry ticket to the federal cloud market. It is a superset of R5 Low and a subset of R5 High. Its overlap with CMMC Level 2 creates the dual-use compliance opportunity described in the coverage path section.

FedRAMP R5 (High)

Cloud systems supporting the most sensitive unclassified federal missions. The FedRAMP High market is smaller by volume than Moderate but higher in individual contract value: FBI criminal justice databases, DHS national security platforms, HHS public health emergency systems, Treasury financial transaction infrastructure, ODNI intelligence community unclassified workloads.

Underestimating the operational cost of ConMon at High. R5 High ConMon requires weekly vulnerability scans for critical asset categories, real-time SIEM alerting with documented response SLAs, semi-annual contingency plan tests (full recovery exercises), annual adversarial simulation exercises, and SOC integration with agency security infrastructure. Sustaining this programme requires a dedicated 2-4 person FedRAMP compliance function and 24/7-capable SOC. CSPs who achieve High authorisation without building out this operational infrastructure find their first annual ConMon cycle unsustainable.

Approximately 421 controls at maximum stringency. Beyond what R4 High required, R5 High adds: the complete SR family at maximum stringency (SR-9 Tamper Resistance requires active detection of hardware and software tampering, not just policy against it; SR-11 Component Authenticity requires positive cryptographic verification of all software components); CA-8 now requires adversarial simulation -- structured red team exercises simulating nation-state TTPs using MITRE ATT&CK -- in addition to standard penetration testing; IA-2 mandates phishing-resistant MFA for all access, not just privileged access; SI-4 requires threat intelligence integration and UEBA-based anomalous behaviour detection. Personnel security requires Tier 3 investigations minimum for privileged roles, Tier 5 for highest-privilege roles.

The number of FedRAMP High-authorised services in the Marketplace is significantly smaller than Moderate, primarily because the investment to achieve and maintain High authorisation is substantially greater. This creates a less competitive market for CSPs who do achieve it. Agencies reviewing High packages conduct more thorough reviews than Moderate -- requesting full SSP and SAR access, security team briefings, and often imposing contractual requirements beyond the FedRAMP baseline. Budget 3-6 months for the agency ATO review process at High.

R5 High is the apex tier of the current programme. The approximately 80-85% overlap with DoD IL5 makes it strategically valuable beyond the civilian agency market. R5 High and DoD IL5 can be pursued as a combined programme with shared evidence, reducing duplicate effort for CSPs targeting both markets.

FedRAMP R5 (LI-SaaS)

SaaS vendors offering low-risk productivity, collaboration, or utility tools to federal agencies where the service stores no federal operational data. The eligibility criteria are identical to R4 LI-SaaS: SaaS delivery only, no CUI, no Privacy Act data, no federal operational content. The product categories that typically qualify are unchanged from R4: collaboration tools without persistent content storage, survey platforms, project management tools for non-sensitive work.

Eligibility loss through undocumented actual use. The eligibility test that matters is not ''what is this product designed for'' but ''how are federal agencies actually using it.'' Federal users store sensitive information in systems not designed for it with surprising regularity. A survey platform used to collect sensitive policy feedback, a project management tool used to track sensitive procurement activities, a collaboration tool used to share documents with controlled content -- each of these takes the system out of LI-SaaS scope. CSPs that do not conduct structured actual-use interviews with their federal customers and document the results in the SSP are taking an eligibility risk that their 3PAO will not catch.

Approximately 36 controls, updated to R5 identifiers. The changes from R4 LI-SaaS are intentionally modest: control identifiers updated to R5 numbering, SR-1 (Supply Chain Risk Management Policy) added at a foundational level (a policy document, not a full programme), privacy threshold analysis obligations clarified, IA-2 parameters updated. The assessment process is unchanged: A2LA-accredited 3PAO, SAP, SAR, POA&M, 4-8 week assessment timeline, $75,000-$200,000 total cost. The R4-to-R5 LI-SaaS transition is the lightest in the entire FedRAMP programme -- most CSPs complete it in 2-4 months.

Agency ATOs issued individually per agency. A CSP may hold simultaneous ATOs from multiple agencies. Each agency''s ATO may include agency-specific additional requirements. When transitioning from R4 to R5, each agency customer with an active ATO referencing the R4 package needs notification and a local ATO update -- primarily a communication and documentation exercise.

R5 LI-SaaS is a tailored subset of R5 Low. Upgrading from LI-SaaS to full Low requires a new SSP -- the documentation architectures are different. For SaaS companies with growing federal business, the LI-SaaS-to-Low transition is the most common pathway change in the FedRAMP programme.

CMMC Level 2 uses NIST 800-171 control identifiers, which are different from FedRAMP''s NIST 800-53 identifiers even when they address the same security objective. Documentation formats, assessment methodologies (C3PAO for CMMC vs A2LA-accredited 3PAO for FedRAMP), and evidence packages are non-transferable. A CSP cannot submit a FedRAMP SSP to satisfy CMMC requirements or vice versa, even though the underlying security controls substantially overlap.

Access control, configuration management, audit logging, incident response, identification and authentication, system and communications protection. These control families appear in both FedRAMP Moderate baselines and CMMC Level 2 (which is derived from NIST 800-171, itself derived from NIST 800-53 Moderate). The control overlap is approximately 70-80%.

DoD assessments (PA -- Provisional Authorization) are conducted by DISA-approved assessors under DoD-specific frameworks, not A2LA-accredited 3PAOs. DoD imposes specific contractual terms (DFARS clauses), data handling requirements, and infrastructure separation obligations not present in FedRAMP. IL5 adds requirements for separation of National Security System workloads from general-purpose cloud infrastructure. IL6 covers classified information and is outside FedRAMP scope entirely.

The full NIST 800-53 control set at high stringency, physical security, personnel security, cryptographic requirements, continuous monitoring, incident response. Approximately 80-85% overlap between FedRAMP High and DoD IL4/IL5 in terms of implemented security controls.

EO 14028 and OMB M-22-09 are agency-facing requirements that impose ZTA maturity targets on agency information systems. FedRAMP authorises CSP platforms -- the CSP must provide a capable platform, but ZTA implementation obligations fall on the agency using the platform. A FedRAMP R5 Moderate ATO does not automatically satisfy an agency''s ZTA maturity requirements under M-22-09. CSPs who document their ZTA alignment mapping are better positioned in agency evaluations, but it is supplementary to the FedRAMP authorisation, not equivalent.

Supply chain risk management (R5 SR family directly responds to EO 14028 SBOM requirements), identity-centric access (R5 enhanced IA controls align with ZTA identity pillar), continuous monitoring (R5 SI-4 telemetry sharing aligns with ZTA continuous monitoring pillar), micro-segmentation (R5 SC-7 boundary protection addresses ZTA network pillar).

Selecting a baseline before completing FIPS 199 categorisation

CSPs enter the FedRAMP process with a target baseline already selected -- usually Moderate, because that is what most federal contracts specify. They build the SSP for Moderate, engage a 3PAO, and then the 3PAO or sponsoring agency asks for the FIPS 199 categorisation documentation. When the categorisation is done properly, using NIST SP 800-60 Volume II information type tables, the result sometimes differs from the assumed baseline. The categorisation was never the starting point -- it was an afterthought that had to match the pre-selected baseline.

Rebuilding documentation for the correct baseline mid-process. If the correct baseline turns out to be Low rather than Moderate, 200 controls of implementation and documentation work is largely wasted. If the correct baseline is High rather than Moderate, the CSP is already 12-18 months into an authorisation process that cannot reach the target without fundamentally different infrastructure, personnel security programmes, and assessment scope. The cost is not just the sunk documentation -- it is the market time lost.

Treating inherited controls as implementation-free

The FedRAMP inheritance model is genuinely powerful: a CSP building on AWS GovCloud inherits physical security, environmental controls, hardware maintenance, and infrastructure-level controls from AWS. This inheritance covers a meaningful portion of the total control set. CSPs extending this logic assume that if a control is listed as ''inherited'' or ''partially inherited'' in the SSP template, no CSP-level implementation is needed. This assumption is wrong for partial inheritance. SC-28 (protection of information at rest), for example: AWS can provide the encryption capability, but the CSP must configure it correctly for their specific workloads. Claiming full inheritance without verifying the specific configuration is an assessment finding.

3PAO findings during assessment that require implementation work -- work that should have been done during preparation. These findings create remediation cycles that push assessment completion dates back by months. More consequentially, they sometimes reveal that controls the SSP claims are inherited are actually not implemented at all, because the CSP assumed the inheritance handled it. Finding this during assessment rather than preparation is expensive.

Beginning the R4-to-R5 transition without operationalising SR controls first

The natural instinct for a compliance team managing an R4-to-R5 transition is to start with what they know: updating control descriptions in the SSP. They map R4 control identifiers to R5 equivalents, update parameter values, and produce an R5-compliant documentation set. When they reach the SR family, they write policy documents and plan documents. The documents look complete. They engage a 3PAO with what appears to be a ready package. The 3PAO requests evidence of SR control implementation -- an SBOM file, supplier assessment records, tamper detection logs for R5 High -- and finds nothing.

A failed assessment cycle with findings across the entire SR section. The CSP must implement the missing capabilities, generate operational evidence across sufficient time to demonstrate ongoing compliance (not just a one-time run), and re-engage the 3PAO. This adds 3-6 months and the cost of a partial re-assessment to the transition timeline. The clients who avoid this failure are the ones who treat the SR implementation as a 6-month engineering project that precedes documentation, not follows it.

Underestimating the per-agency ATO overhead for LI-SaaS

LI-SaaS is marketed (including by FedRAMP programme materials) as the lightweight pathway. The 36-control set, the shorter assessment, and the lower cost create an accurate picture of the authorisation effort. What is less visible is that each agency customer requires their own ATO. A CSP with 15 agency customers under LI-SaaS has 15 separate legal instruments to maintain, each potentially with different agency-specific requirements layered on top of the baseline. When the CSP transitions from R4 to R5 LI-SaaS, each of those 15 agencies needs to be notified, briefed, and guided through a local ATO update. This is a significant programme management burden that scales with the number of agency customers.

CSPs with large federal agency customer bases under LI-SaaS discover that the ongoing programme management overhead -- tracking ATO expiration dates, managing agency-specific requirement variations, coordinating R5 transition notifications across multiple agencies simultaneously -- requires dedicated compliance resources that were not factored into the business model when they chose LI-SaaS as their authorisation pathway.