GovRAMP authorization tiers explained: Core, Low, Low+, Moderate, and High

GovRAMP Core

Every cloud service provider participating in the GovRAMP program at any tier. Core is not a standalone authorization level that government agencies procure against -- it is the baseline control set that every GovRAMP-authorized vendor must satisfy regardless of which impact tier they are pursuing. A vendor seeking Low+ or High still implements Core as the foundation.

Vendors treat Core as a checkbox completed at initial authorization and deprioritize it during routine operations. The most common lapse is documentation drift -- System Security Plans that no longer reflect the current architecture because the vendor made infrastructure changes without updating the authorization package. When the annual reassessment arrives, the 3PAO finds a documented environment that diverges from the live one, which triggers findings and delays the authorization renewal.

Core establishes the minimum operational and governance requirements for GovRAMP participation: formal System Security Plan documentation, engagement with an accredited third-party assessor (3PAO), commitment to continuous monitoring reporting obligations, and implementation of foundational NIST SP 800-53 controls that apply across all impact levels. Core is best understood as the program participation requirements rather than a standalone security baseline. It covers controls that are non-negotiable regardless of data sensitivity: basic access management, fundamental audit logging, incident reporting procedures, and system documentation standards.

Failure to maintain Core requirements results in removal from the GovRAMP marketplace -- the listing that government agencies check when procuring cloud services. There is no separate Core enforcement action; Core is enforced as part of the overall authorization maintenance requirements. A vendor that lets its Core obligations lapse effectively loses its authorization at every tier.

Core is the prerequisite for every other tier. It is also the control area where the GovRAMP PMO most frequently identifies compliance gaps during annual reviews, because vendors focus their compliance attention on the tier-specific controls rather than on the foundational documentation and reporting obligations that cut across all levels.

GovRAMP Low

Cloud services processing government data where unauthorized disclosure, modification, or destruction would have a limited adverse effect on government operations, individuals, or organizational assets. Practical examples: public-facing government websites, general productivity tools used for non-sensitive work, citizen engagement platforms that collect contact information but not sensitive case data, and document management systems for publicly available records. The key test is FIPS 199 impact categorization -- if confidentiality, integrity, and availability failures all score ''limited'' impact, Low is the appropriate tier.

Agencies using Low-authorized services for data that creeps into Moderate territory over time. A public-facing citizen portal authorized at Low adds a case management module. A document management tool starts receiving HR-related uploads. The platform scope expands without a corresponding tier re-evaluation. The Low authorization is still current; the data handled is no longer Low-impact.

GovRAMP Low implements the NIST SP 800-53 Low baseline -- the subset of controls appropriate for systems where the consequences of failure are bounded. This includes basic access control (unique accounts, access reviews), fundamental audit logging (logon events, privilege use), incident response procedures, configuration management for authorized software, and physical and environmental protections for hosting infrastructure. Low does not require the depth of access management, audit analysis, or encryption controls present in Moderate. Specifically: Low does not mandate multi-factor authentication for all user access, does not require organization-wide continuous vulnerability scanning, and does not mandate encryption of data in transit for all communications.

Government agencies that deploy Low-authorized services for data that should be categorized as Moderate are taking on risk that the authorization does not cover. The GovRAMP PMO does not audit how agencies use authorized services -- the enforcement mechanism is the agency''s own data classification and procurement governance. If a state agency deploys a Low-authorized HR platform and uses it to store employee Social Security numbers, the Low authorization does not protect the agency. It simply means the vendor met a security bar appropriate for a different class of data.

Low is the foundation for Low+ -- a vendor with an existing Low authorization implements incremental additional controls to reach Low+. Low is also fully contained within Moderate, meaning a Moderate-authorized vendor satisfies all Low requirements by definition. Agencies that require Low+ or Moderate authorization do not need to maintain separate Low listings.

GovRAMP Low+

Cloud services handling government data that is more sensitive than the Low threshold but does not require the full Moderate control set. Practical examples include internal government HR systems handling limited employee data without sensitive financial or health information, internal collaboration platforms for non-public government business processes, and administrative systems that process non-public data with limited external exposure. Low+ exists because the FIPS 199 categorization produces a binary Low/Moderate distinction that does not map cleanly to the actual distribution of government data sensitivity. A meaningful population of government systems sits genuinely between these two points.

Treating Low+ as a procurement default when the actual data warrants Moderate. The rationale is usually cost and timeline -- Low+ is faster and cheaper than Moderate, and agencies convince themselves that their data is ''probably Low+.'' When the actual data classification exercise is done rigorously, many systems thought to be Low+ turn out to require Moderate. The GovRAMP documentation explicitly requires a FIPS 199 categorization before tier selection. Many agencies skip this step or treat it as a formality.

Low+ adds a targeted set of controls to the Low baseline in three primary areas: identity and access management (enhanced verification requirements, stronger session controls, more granular role-based access policies), audit and accountability (more comprehensive event logging categories, longer retention requirements, and audit review procedures), and configuration management (stricter secure baseline configuration requirements and change control procedures). Low+ does not add the full Moderate requirements for encryption, continuous vulnerability scanning at scale, or the more advanced incident response and contingency planning controls. It is a selective uplift, not a halfway point to Moderate across all control domains.

Low+ does not exist in FedRAMP, which means there is no federal authorization counterpart. Vendors with FedRAMP Low authorization cannot claim Low+ coverage -- the additional controls are genuinely distinct. Government agencies specifying Low+ in procurement requirements are narrowing the eligible vendor pool to those who have specifically pursued this tier, which is currently smaller than either Low or Moderate pools.

Low+ is the only tier in GovRAMP that has no FedRAMP equivalent -- it is specific to the state and local government program. This creates a practical challenge for vendors pursuing dual FedRAMP and GovRAMP authorization: their FedRAMP Low authorization underpins the Low portion, but the Low+ delta requires GovRAMP-specific implementation and assessment work with no federal authorization shortcut available.

GovRAMP Moderate

Cloud services where a security breach would cause serious adverse effects: significant financial harm, harm to individuals whose data is exposed, or major disruption to government operations. In practice, this covers the majority of non-public government cloud deployments. Any system handling personally identifiable information at meaningful scale, financial records, law enforcement data that is not the most sensitive CJIS material, health information for government employees, benefits administration, and case management systems for social services all fall at the Moderate tier. If the system handles data that you would not want published in a newspaper, it is almost certainly Moderate.

GovRAMP Moderate implements a substantial set of NIST SP 800-53 Moderate baseline controls spanning all major security domains. Key requirements beyond Low include: multi-factor authentication for all privileged accounts and remote access; encryption of data in transit and at rest; automated vulnerability scanning on a defined cadence with documented remediation SLAs; centralized log management with retention policies; formal business continuity and disaster recovery plans with tested recovery procedures; detailed incident response procedures with defined escalation and reporting timelines; and supply chain risk management controls. Monthly continuous monitoring reporting to the GovRAMP PMO is mandatory, covering vulnerability scan results, configuration compliance status, and any security incidents or significant system changes.

GovRAMP Moderate authorization is increasingly written as a mandatory requirement rather than a preference in state and local government RFPs for sensitive workloads. The practical consequence of being unauthorized when a procurement requires Moderate is disqualification, regardless of the vendor''s actual security posture. The absence of a GovRAMP marketplace listing is the disqualifying condition -- not the underlying controls. A vendor with genuinely strong security but no GovRAMP Moderate authorization loses to a less secure vendor that has completed the authorization process.

Moderate is the practical target for most vendors entering the government market. It satisfies all Low and Low+ requirements, makes the vendor eligible for the broadest range of state and local government procurements, and establishes the control foundation from which High authorization can be pursued. Vendors who pursue Moderate first spend zero additional effort achieving Low and Low+ -- those tiers are fully covered. The reverse is not true: a vendor who builds Low first and then upgrades to Moderate faces the full delta between the two baselines, which is substantial.

GovRAMP High

Cloud services supporting the most critical and sensitive government functions where a breach could cause severe or catastrophic harm -- including threats to public safety or life. Specific use cases: criminal justice information systems (CJIS), public safety answering points and emergency communications platforms, systems supporting critical infrastructure management (water, power, transportation), emergency management and coordination platforms, and systems where data confidentiality failures could enable physical harm to individuals. GovRAMP High is not appropriate for general sensitive data. The test is whether a breach would cause serious harm to public welfare or safety -- not just organizational inconvenience or individual financial harm.

Pursuing High when Moderate is sufficient -- driven by agency risk aversion rather than genuine data sensitivity analysis. The consequence is market distortion: fewer vendors hold High authorization, so procurement specifications that require High unnecessarily narrow the eligible vendor pool, increase procurement costs, and create longer procurement timelines without proportionate security benefit. The correct starting point is always a data classification exercise. If the FIPS 199 categorization produces a High result, High is required. If it produces Moderate, specifying High in the RFP is an organizational risk preference that should be documented as such, not treated as a security requirement.

GovRAMP High implements the full NIST SP 800-53 High baseline -- the complete control set with no simplifications. Control additions beyond Moderate are concentrated in areas that matter for critical systems: enhanced personnel security including background investigation requirements for staff with system access; more rigorous access control including privileged access management with session monitoring; more frequent and comprehensive vulnerability assessment; stricter change management with security impact analysis for every change; comprehensive system resilience requirements including site redundancy and tested failover; and heightened continuous monitoring with more frequent reporting cycles. The 3PAO assessment at High is the most intensive in the program -- more extensive control testing, more documentation review, and longer assessment timelines.

The regulatory intersection at High is complex. Criminal justice information systems must also comply with CJIS Security Policy, which has its own requirements distinct from GovRAMP High. The two frameworks address overlapping control areas but are not interchangeable -- a GovRAMP High authorization does not automatically satisfy CJIS requirements. Agencies handling CJIS data in cloud systems must confirm with their CJIS Systems Officer that GovRAMP High authorization is accepted as satisfying CJIS technical security requirements, or maintain separate CJIS compliance documentation alongside the GovRAMP authorization.

High is the ceiling of the GovRAMP program and the rarest authorization. It mirrors FedRAMP High in control requirements, making it one of the few GovRAMP tiers where FedRAMP authorization provides substantial, though not complete, overlap. A vendor with FedRAMP High authorization has satisfied most of the control requirements for GovRAMP High, though the separate GovRAMP assessment and marketplace listing are still required for state and local procurement eligibility.

The divergence is qualitative, not just quantitative. Low requires basic access controls. Low+ adds enhanced verification and role-based access policies. Moderate adds multi-factor authentication requirements, privileged access management, and access review frequency that the lower tiers do not mandate. It is not more of the same control -- it is a different class of requirement. Vendors who believe upgrading from Low to Moderate is a matter of adding more documentation to existing controls are typically surprised to find they need architectural changes to authentication infrastructure.

The NIST SP 800-53 control families that are present in the Low baseline carry forward into every higher tier. Access control fundamentals (unique accounts, separation of duties at a basic level, account management procedures), audit logging of key system events, incident response process documentation, and configuration management for authorized software are all present across Low, Low+, and Moderate. A vendor building to Moderate does not need to reimplement these controls -- the Low-tier work is subsumed.

High adds requirements that have no Moderate counterpart at all, not just stronger versions of existing controls. Personnel security background investigation requirements at High are more extensive than at Moderate. Site redundancy and availability requirements at High assume life-safety dependency in ways that Moderate does not. The 3PAO assessment process at High includes testing scenarios that are not performed at Moderate -- specifically around failure modes and recovery under adversarial conditions. These are not incremental tightening of Moderate controls; they are new requirement categories.

The 800-53 Moderate baseline is fully contained within High. Every Moderate control is an active requirement at High. The High additions are concentrated in personnel security, physical security at hosting facilities, system resilience, and the depth of continuous monitoring -- areas where the consequences of failure at High make the Moderate baseline insufficient.

The reporting cadence and the consequences of findings differ materially by tier. At Low, a vulnerability finding triggers a remediation timeline that is reasonable for a lower-risk system. At High, unresolved critical vulnerabilities can trigger temporary authorization suspension while remediation is validated. The continuous monitoring obligation is structurally identical across tiers; the tolerance for deviation is not.

Continuous monitoring obligations apply at every tier. The frequency, depth, and reporting format vary by tier -- monthly reporting at Moderate and High, less intensive at Low and Low+ -- but the fundamental requirement that authorized vendors maintain and report on their security posture on an ongoing basis is universal. Annual reassessment by a 3PAO is required at all authorization levels.

Vendors assuming FedRAMP authorization satisfies GovRAMP requirements

The technical overlap is real and substantial. FedRAMP and GovRAMP share the NIST SP 800-53 foundation, use the same impact level definitions, and employ similar 3PAO assessment processes. Vendors who spent 12 months and significant resources earning FedRAMP Moderate naturally read GovRAMP as a lightweight derivative. The documentation reinforces this -- GovRAMP explicitly models itself on FedRAMP and acknowledges the overlap. What the documentation does not emphasize clearly enough is that the programs are governed by separate bodies, use separate marketplace listings, and require separate assessments. A FedRAMP Moderate authorization is evidence of strong security posture; it is not a GovRAMP Moderate authorization.

Vendors miss procurement opportunities in states that have formalized GovRAMP as a requirement. The window matters: procurement cycles in state government are typically 12 to 24 months from RFP to contract award. A vendor that discovers the FedRAMP/GovRAMP distinction after an RFP is published has no time to close the gap before bid submission. The GovRAMP authorization process itself takes 6 to 12 months at Moderate. The consequence is not just one lost contract -- it is systematic exclusion from a market segment while the authorization process runs.

Agencies specifying Moderate when Low+ is the technically correct tier

Risk aversion expressed through tier specification is common in government procurement. Program managers who are unfamiliar with the FIPS 199 categorization process default to the next tier up as a hedge. Legal and compliance teams, aware that a data breach would be damaging, push for the highest defensible standard. The result is procurement specifications that require Moderate authorization for systems that, when a proper data classification is done, would legitimately categorize as Low+. No one is explicitly told they are overspecifying; they are told the higher tier provides more assurance, which is technically true even when disproportionate.

Overspecification narrows the eligible vendor pool without a corresponding security benefit. If the data genuinely categorizes as Low+ and the agency requires Moderate, smaller vendors with Low+ authorization are excluded from consideration. The agency may end up with a larger, more expensive vendor when a lower-cost option would have provided equivalent protection for the actual data. More practically: agencies that routinely overspecify tiers contribute to a procurement environment where Low+ authorization is undersupported by vendor investment, because the market signal says Moderate is what government buyers require.

Treating initial authorization as the endpoint rather than the starting line

The authorization process is long, expensive, and intensive. Vendors who have completed it experience a natural decompression -- the audit passed, the marketplace listing is live, the sales team can reference the authorization. The continuous monitoring obligations feel like maintenance rather than mission-critical operations. Security staff who were fully engaged during the assessment phase shift attention to product development and customer delivery. The monthly reporting requirements continue, but they are handled as paperwork rather than as genuine security oversight. The compliance machinery keeps running; the security intent behind it gradually fades.

Authorization degradation is not instantaneous -- it accumulates. At month 12 post-authorization, the gaps are manageable. At month 18, the annual reassessment is approaching and the vendor is scrambling to close findings that accumulated while attention was elsewhere. In the worst case, the reassessment produces enough significant findings that the authorization is suspended while remediation is completed -- a fact that becomes visible in the GovRAMP marketplace and triggers questions from every government customer currently using the platform. The authorization that was earned as a sales credential becomes a sales liability.