FedRAMP impact levels: Low, Moderate, and High compared
Geert WarmenbolApril 29, 2026
Key takeaways
FIPS 199 uses a high-water mark rule: if any single security objective -- Confidentiality, Integrity, or Availability -- rates High, the entire system is High. One miscategorized data type elevates the whole authorization.
12% of systems initially categorized as FedRAMP Moderate should be High after a thorough data classification exercise, according to Vulnox assessment data. The most common cause is underestimating PII scope.
FedRAMP Moderate requires approximately 325 controls. FedRAMP High requires approximately 421. The 96-control difference understates the real cost gap -- High controls carry stricter parameter values that affect encryption, authentication, and scanning frequency.
FedRAMP Equivalency (introduced 2023) allows DoD Impact Level 2 workloads to use commercial FedRAMP Moderate authorizations. Most CSPs pursuing DoD contracts are still paying for separate IL2 audits they no longer need.
CA-7 (Continuous Monitoring) is the single control most responsible for post-authorization ATO revocations. Monthly scan submission failures -- not security incidents -- are the documented trigger in most revocation cases.
Vulnox observes 38% compliance drift in authorized systems within six months of receiving their ATO. The authorization process creates a compliance peak. What follows is entropy unless the monitoring infrastructure is built before authorization, not after.
TL;DR
FedRAMP impact level selection is a data classification problem, not a compliance preference. The FIPS 199 high-water mark rule means one miscategorized data type can force a full High authorization on a system that was built for Moderate. Most CSPs discover this late and pay for it in timeline and remediation cost. The more important question is not which level to target but whether your data classification is accurate enough to defend the choice.
The miscategorization that added nine months
A SaaS company providing case management software to a federal civilian agency spent eight months preparing for FedRAMP Moderate authorization. The data classification was done by the product team, not security. They documented that the system processed case notes and workflow data -- nothing that looked sensitive. The 3PAO's readiness assessment found that case notes for one agency customer included income verification data and Social Security Numbers. One data type. That triggered a FIPS 199 re-categorization under Confidentiality from Moderate to High. High-water mark rule: the whole system moved to High. Nine months of remediation work to add 96 controls they had not planned for.
The product team was not wrong about what the system was designed to process. They were wrong about what it actually stored. Those are different questions, and FIPS 199 asks the second one.
How FIPS 199 high-water marking actually works
FIPS 199 defines three security objectives: Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access). Each objective gets an independent impact rating: Low, Moderate, or High. The rating reflects the potential harm to organizational operations, assets, or individuals if a security failure occurred against that objective. The high-water mark rule is the mechanism most teams get wrong. The overall system impact level is set by the highest individual objective rating. If Confidentiality is Moderate, Integrity is Low, and Availability is High -- because a service outage would prevent emergency response functions -- the system is FedRAMP High. Full stop. There is no averaging, no weighting, no appeal to the other two objectives.
Example
The availability dimension catches organizations that do not think of themselves as processing sensitive data. A logistics platform handling federal supply chain coordination might process nothing more sensitive than shipment tracking. But if that platform supports time-critical operations where a 24-hour outage would disrupt emergency response, Availability rates High. That is enough. The system becomes High regardless of Confidentiality and Integrity ratings. Vulnox sees this pattern most often in operational technology adjacent systems and platforms that support field operations.
NIST SP 800-60 provides the mapping tables that translate information types to impact ratings. Most organizations do not work through 800-60 systematically. They estimate. That estimate is what the 3PAO tests. A classification worksheet that cannot be defended against 800-60 mapping tables is a gap finding waiting to happen.
What data classification exercises actually uncover
Assessment base: Vulnox assessment data, 2024, across CSP environments pursuing FedRAMP Low, Moderate, and High authorization
12% of Moderate systems belong at High
Across Vulnox assessments, 12% of systems initially categorized as FedRAMP Moderate require re-categorization to High after a thorough data classification exercise (Vulnox assessment data, 2024). The most common driver is PII scope underestimation. Product teams classify the system based on its primary function. They miss secondary data types that accumulate in logs, audit trails, user profile fields, and integration payloads. The system was designed to process workflow data. It turns out it also stores the names, email addresses, and agency identifiers of all federal users -- which qualifies as PII under NIST SP 800-122 and elevates Confidentiality from Moderate to High in most federal data classification frameworks.
A Moderate authorization built on a miscategorized system is structurally vulnerable to invalidation. If an agency's ISSO conducts their own data classification review post-authorization, a re-categorization triggers a complete controls gap analysis and can force a new assessment at the higher level. The authorization cost was real. The ATO shelf life is not guaranteed.
38% compliance drift within six months of authorization
Vulnox observes 38% compliance drift in authorized FedRAMP systems within six months of receiving their ATO (Vulnox assessment data, 2024). The pattern is consistent: authorization creates a compliance peak. The team that built the evidence package disperses. New infrastructure gets deployed without going through the change management procedures documented in the SSP. A new integration is added that was not in the original system boundary diagram. Configuration baselines drift as patches are applied and engineers make operational adjustments.
The authorization package accurately described the system at one point in time. Six months later, the system boundary documentation and the actual system are different objects. The next annual assessment will find the delta. ConMon is not just about submitting monthly scan reports -- it is about maintaining the accuracy of the authorization package as the system evolves.
CA-7 ConMon as the primary revocation driver
CA-7 (Continuous Monitoring) generates more post-authorization compliance failures than any other control family in Vulnox's client base. The mechanism is simple: monthly vulnerability scan reports are required deliverables to the agency ISSO. Most CSPs staff ConMon with the engineer who led the authorization effort. When that person leaves, submission cadence breaks within 60 to 90 days. The PMO has documented ATO revocations for two consecutive missed monthly deliverables. Not for security incidents. For missing paperwork.
ConMon is an operational function, not a compliance one-time event. CSPs that treat it as a reporting obligation rather than a staffed security function are planning for eventual revocation. The ConMon infrastructure -- tooling, process, staffing, escalation path -- should be operational before the assessment completes, not assembled after the ATO arrives.
Third-party software trust assumptions at High
At FedRAMP High, supply chain risk management controls (SR family) require documented assurance for third-party software components. In practice, licensed commercial software is frequently trusted by default because the licensing agreement is treated as an implicit security guarantee. It is not. Vulnox assessments at High impact level consistently find undocumented third-party components in the system boundary that have not been subjected to the software provenance review required under SR-3 and SR-4.
At Moderate, this is a finding. At High, it is a potential authorization blocker. The SR control family is one of the areas where High adds meaningful new requirements rather than just tightening Moderate parameters. CSPs targeting High authorization who have not audited their third-party software inventory are carrying an unknown gap.
Low, Moderate, and High: what actually changes between levels
FedRAMP Low (125 controls)
Designed for systems processing public information or data where confidentiality, integrity, and availability failures produce limited adverse effects. The LI-SaaS (Low Impact Software as a Service) pathway reduces controls further to 37 for qualifying products. Annual penetration testing is not required at Low. ConMon requirements are lighter. Most agencies will not use Low-authorized services for anything involving non-public federal data.
Low authorization provides market access for limited use cases. It does not position a CSP competitively for contracts involving CUI. For most commercial SaaS companies entering the federal market, Low is a starting point, not a destination.
FedRAMP Moderate (325 controls)
The most common authorization level. Required for systems processing Controlled Unclassified Information (CUI). FedRAMP-specific parameter overrides begin to diverge meaningfully from base NIST 800-53 at this level. Multi-factor authentication requirements, audit log retention periods, and vulnerability scan frequency are all tighter than the NIST baseline. Annual penetration tests are required. Monthly ConMon deliverables to the agency ISSO are mandatory.
Moderate is the practical baseline for competing in the federal civilian market. Most agency workloads that do not involve PHI, law enforcement data, or national security information land here. A Moderate authorization built on accurate data classification and a sustainable ConMon infrastructure is the right target for the majority of commercial CSPs.
FedRAMP High (421 controls)
Required for systems processing data where a security failure could have severe or catastrophic effects -- PHI, law enforcement information, financial data, and systems supporting critical infrastructure or emergency response. The 96-control increase from Moderate includes the full SR (Supply Chain Risk Management) family, stricter IA (Identification and Authentication) requirements that eliminate SMS MFA, mandatory hardware-based authentication for privileged access, and more frequent penetration testing. Agency-specific parameter overlays are common at High and add requirements beyond the baseline.
High authorization is expensive and operationally demanding. The 3PAO assessment cost for High typically runs 40 to 60% higher than Moderate. ConMon staffing requirements are heavier. The market it opens -- DoD, HHS, law enforcement agencies, financial regulators -- is also larger and higher-value. The business case is real, but the infrastructure investment is not optional.
DoD IL2 and FedRAMP Moderate are now the same thing
Common belief
CSPs targeting DoD contracts assume they need a separate Impact Level 2 authorization process, with its own assessment, its own 3PAO engagement, and its own ongoing compliance overhead. Most are still paying for exactly that.
What we found
In Vulnox assessments of CSPs with DoD client targets, the majority are unaware of the equivalency pathway and have scoped their compliance programs to include separate IL2 work. When the equivalency option is presented, the typical reaction is disbelief followed by a budget review. The cost difference can exceed $300,000 in avoided assessment and remediation expense.
FedRAMP Equivalency, introduced in 2023, allows DoD Impact Level 2 workloads to leverage an existing FedRAMP Moderate commercial authorization. IL2 covers unclassified DoD information that does not qualify as Controlled Unclassified Information -- the same data type FedRAMP Moderate is designed for. The equivalency pathway eliminates the requirement for a separate DISA assessment for IL2 workloads if the CSP holds a valid FedRAMP Moderate ATO. This is not a loophole or a transitional measure. It is official DoD policy. The number of CSPs pursuing separate IL2 audits for workloads that qualify under equivalency is a direct cost of awareness failure, not technical necessity.
Where impact level decisions go wrong
Classification based on design intent, not actual data
Systems get classified based on what they were built to process. Auditors and FIPS 199 categorizations ask what data the system actually stores, transmits, and processes under operational conditions. Log files, error messages, audit trails, and API payloads frequently contain data types that were not part of the original design intent. A workflow platform that integrates with an HR system may transmit employee identifiers and salary bands in API responses even if neither field is displayed in the UI. That data is in the system. FIPS 199 does not distinguish between intended and incidental data handling.
Availability impact assessed against normal operations
Organizations assess Availability impact based on their own business operations. Federal agencies assess it based on mission impact. A scheduling platform might rate Availability as Low because a 24-hour outage is an inconvenience for the vendor. If that platform supports an agency's field operations and an outage disrupts coordination for emergency response functions, the agency's Availability rating is High. The agency's classification governs. FIPS 199 categorization must account for the agency context, not just the CSP's internal risk assessment.
ConMon infrastructure as an afterthought
Most CSPs build their ConMon infrastructure after receiving their ATO. The authorization effort consumes all available resources. What gets assembled for ConMon in the weeks after authorization is typically lighter than what the SSP documented. Monthly scan submissions start on time. After six months, the cadence slips. The tooling was not production-grade. The process was not documented in a way that survives personnel turnover. 38% compliance drift within six months is not a discipline failure -- it is an infrastructure failure that was predictable at authorization time.
Two structural problems that will surface before 2027
FedRAMP Equivalency will produce a class of DoD IL2 authorizations that are technically compliant and operationally undermaintained. By mid-2026, at least one equivalency-based authorization will face revocation due to ConMon failures on the commercial FedRAMP side, causing downstream disruption to DoD workloads that had no visibility into the underlying authorization health.
Equivalency creates a dependency chain. DoD IL2 workloads rely on the commercial FedRAMP Moderate authorization remaining valid. ConMon failures on the commercial authorization propagate to IL2 workloads. DoD program managers using equivalency-based authorizations are often not monitoring the commercial ATO's ConMon health. The visibility gap is structural.
Confidence: mediumA documented case of DoD IL2 workload disruption caused by revocation of the underlying commercial FedRAMP Moderate authorization appearing in PMO or DISA reporting before July 2026.The FedRAMP PMO will introduce formal compliance drift metrics as a ConMon deliverable requirement by Q2 2027, requiring CSPs to document configuration baseline delta between the authorized SSP state and current system state on a quarterly basis.
38% compliance drift in six months is not a secret -- the PMO sees it through annual assessment findings and ConMon review. The current ConMon framework requires scan submissions and POA&M updates but has no mechanism for detecting undocumented system changes. The authorization package becomes a historical document. The gap between documented and actual system state is the primary risk the current framework fails to address.
Confidence: mediumFedRAMP PMO guidance issued before Q2 2027 introducing a configuration baseline attestation requirement as part of annual ConMon review, or absence of such guidance confirming the gap persists.
The authorization package and the running system are two different things
The FedRAMP authorization model is built on a snapshot. The SSP describes the system at assessment time. The authorization is granted based on that description. Then the system keeps running, changing, and accumulating drift while the documentation stays static. This is not a process failure -- it is an architectural one. The compliance model treats the system as a fixed object that needs periodic re-verification. Real systems are continuous objects that change faster than annual assessment cycles can track. Until the authorization model requires continuous evidence of system state rather than periodic snapshots of it, compliance drift is not a risk to manage. It is the default outcome.
Counterargument
The counterargument is that continuous evidence requirements would impose prohibitive operational overhead on CSPs, particularly smaller organizations, and that the annual assessment plus monthly ConMon model is a reasonable balance between assurance and cost. That position is coherent. What it does not explain is why 38% drift in six months is acceptable assurance for systems processing federal data.
One concrete step before you select an impact level
Before you file a FIPS 199 categorization worksheet, pull your system's data flows from production -- not from design documentation. Map every data type that actually moves through the system: API payloads, log entries, audit trails, error messages, integration outputs. For each data type, apply the NIST SP 800-60 mapping tables to get an impact rating per security objective. Do this before you engage a 3PAO, before you scope an SSP, and before you budget an authorization. If the categorization that comes out of that exercise differs from what your product team assumed, you now know the cost of that assumption before it appears as a finding.
Further Reading
Gap Analysis
framework gap analysisVulnerability Assessment
vulnerability assessmentsFedRAMP baselines explained: R4, R5, Low, Moderate, High, and LI-SaaS
FedRAMP impact levels comparedNIST SP 800-30 Risk Assessment Guide
NIST SP 800-30 guideNational Vulnerability Database NIST
NIST National Vulnerability DatabaseShadow IT Discovery
shadow IT discovery
Frequently Asked Questions
How does FIPS 199 high-water marking affect FedRAMP impact level selection?
FIPS 199 rates three security objectives independently -- Confidentiality, Integrity, and Availability -- and assigns the highest individual rating as the overall system impact level. If any single objective rates High, the entire system is FedRAMP High regardless of the other two ratings. One miscategorized data type can force a full High authorization on a system designed for Moderate.
What percentage of FedRAMP Moderate systems are miscategorized?
Vulnox assessment data (2024) shows that 12% of systems initially categorized as FedRAMP Moderate require re-categorization to High after a thorough data classification exercise. The most common cause is PII scope underestimation -- systems store sensitive data in logs, audit trails, and API payloads that were not part of the original design intent.
What is FedRAMP Equivalency and how does it affect DoD contracts?
FedRAMP Equivalency (introduced 2023) allows DoD Impact Level 2 workloads to use a valid commercial FedRAMP Moderate authorization in place of a separate DISA IL2 assessment. Most CSPs pursuing DoD contracts are unaware of this pathway and are still paying for separate IL2 audits. The cost difference can exceed $300,000 in avoided assessment and remediation expense.
How many controls does FedRAMP High require compared to Moderate?
FedRAMP Moderate requires approximately 325 controls. FedRAMP High requires approximately 421 -- a 96-control increase. The number understates the real gap. High controls carry stricter parameter values affecting encryption algorithms, authentication mechanisms (SMS MFA is not permitted at High), supply chain risk management requirements, and penetration testing frequency.
Why do authorized FedRAMP systems lose compliance after authorization?
Vulnox observes 38% compliance drift in authorized systems within six months of receiving an ATO (2024 data). Authorization creates a compliance peak. After authorization, the team disperses, new infrastructure is deployed without following documented change management procedures, and configuration baselines drift. ConMon infrastructure assembled after authorization rather than before is the structural cause.
What is the most common reason FedRAMP ATOs get revoked after authorization?
CA-7 (Continuous Monitoring) failures drive most post-authorization revocations. The PMO requires monthly vulnerability scan submissions to the agency ISSO. Missing two consecutive monthly deliverables is a documented revocation trigger. Most revocations are not caused by security incidents -- they are caused by submission cadence failures after the engineer who led the authorization effort leaves the organization.
Should a company target FedRAMP Moderate or High for federal contracts?
FedRAMP Moderate covers the majority of federal civilian agency workloads involving Controlled Unclassified Information and is the practical baseline for the federal market. High is required for systems processing PHI, law enforcement data, financial data, or supporting emergency response. The choice should follow the FIPS 199 categorization of the actual data processed, not business ambition or agency preference alone.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.