You're building a cloud service for federal customers. Before you write a single policy or implement a control, you need to answer one question: Low, Moderate, or High?
Get this wrong and you'll spend months documenting unnecessary controls, or worse, you'll build to Low and discover mid-assessment that your agency customer requires Moderate. FedRAMP baseline selection isn't just a checkbox exercise. It's a critical decision that determines whether you're implementing roughly 150 controls or over 400.
Here's how to make that call correctly the first time.
The Problem: Baseline Errors Cost Time and Money
Most cloud service providers don't fail FedRAMP assessments because they can't implement controls. They fail because they chose the wrong baseline and built to the wrong requirements.
Consider what happens when you miscategorize: you scope your System Security Plan to Low, hire staff accordingly, and begin documentation. Three months in, your sponsoring agency reviews your FIPS 199 categorization and flags a confidentiality impact you missed. Suddenly you're Moderate, which means over 170 additional controls, expanded continuous monitoring requirements, and a completely different assessment timeline.
The reverse scenario wastes resources differently. If you assume High when Moderate suffices, you're implementing controls like advanced cryptographic key management and enhanced audit capabilities that federal customers won't pay for and assessors won't credit.
With FedRAMP authorization timelines already stretching 12-18 months for Moderate systems, baseline errors add quarters to your schedule and hundreds of thousands to your cost.
What You Need Before Starting
Before you select a baseline, gather these inputs:
Data inventory: Document every data type your system will process, store, or transmit. Include agency data, user data, system metadata, and logs. Be specific, "agency financial data" tells you nothing; "unclassified budget forecasts" or "CUI marked procurement documents" tells you everything.
Agency requirements documentation: If you're pursuing an agency authorization, obtain their mission needs statement or authorization requirements. Some agencies mandate Moderate for all external cloud services regardless of data sensitivity. Know this before you categorize.
FIPS 199 worksheet: You'll use FIPS 199 to evaluate potential impact across confidentiality, integrity, and availability. NIST SP 800-60 provides sector-specific guidance on information type categorization that maps to FIPS 199 impact levels.
Stakeholder access: You need input from agency customers, your security team, and business owners who understand what happens if the system goes offline or data leaks. FIPS 199 categorization isn't a solo exercise.
Step-by-Step Implementation
Step 1: Categorize Information Types Using FIPS 199
Start with FIPS 199, which defines three impact levels, low, moderate, high, across three security objectives: confidentiality, integrity, and availability.
For each information type your system handles, ask:
- Confidentiality: What's the impact if unauthorized individuals access this data? Limited adverse effect (Low), serious adverse effect (Moderate), or severe/catastrophic effect (High)?
- Integrity: What's the impact if this data is modified or destroyed without authorization?
- Availability: What's the impact if this data or system becomes unavailable?
Document your answers. If your system processes public information with no confidentiality requirement, that's Low for confidentiality. If it handles CUI, which federal agencies are required to protect under Executive Order 13556, you're starting at Moderate for confidentiality.
Step 2: Apply the High-Water Mark Principle
Your system's overall categorization is determined by the highest impact rating across all three security objectives.
If confidentiality is Low, integrity is Moderate, and availability is Low, your system categorizes as Moderate overall. This is the high-water mark principle: the highest single rating determines your baseline.
This principle catches teams off guard. You might think, "We're mostly Low with one Moderate element." FedRAMP doesn't work that way. One Moderate rating means you implement over 320 controls, not 150.
Step 3: Confirm Agency and Mission Requirements
Even if your FIPS 199 categorization suggests Low, your sponsoring agency may require Moderate. Federal agencies increasingly default to Moderate for any system touching sensitive operational data, regardless of technical categorization.
Request written confirmation of baseline requirements from your agency sponsor before you finalize. If you're pursuing Joint Authorization Board (JAB) authorization rather than agency-specific authorization, confirm JAB's baseline expectations during your FedRAMP Connect engagement.
Step 4: Map to FedRAMP Baseline and Security Controls
Once you've confirmed your categorization, map it to the corresponding FedRAMP baseline:
- Low = roughly 150 controls from NIST SP 800-53 Rev 5 Low baseline
- Moderate = over 320 controls from NIST SP 800-53 Rev 5 Moderate baseline
- High = over 400 controls from NIST SP 800-53 Rev 5 High baseline
Download the appropriate baseline template from the FedRAMP website. This template lists every required control, including control enhancements. Your System Security Plan must address each one.
If you're a low-risk SaaS provider and qualify for the LI-SaaS baseline, you'll follow a streamlined process with reduced documentation and simplified continuous monitoring. Confirm LI-SaaS eligibility with FedRAMP before assuming you qualify.
Step 5: Document Your Categorization Rationale
Your FIPS 199 categorization becomes part of your authorization package. Document why you selected each impact level, what data types drove the decision, what agency mission the system supports, and what harm could result from confidentiality, integrity, or availability failures.
Assessors will review this rationale. If your categorization appears inconsistent with your system description or the data you process, expect questions. Be prepared to defend your baseline selection with specifics.
Validation: How to Verify It Works
You've selected a baseline. Here's how to confirm you got it right:
Third-Party Assessment Organization (3PAO) consultation: Before you build out your entire System Security Plan, engage a FedRAMP-authorized 3PAO for a categorization review. They'll spot misalignments between your data types and your claimed baseline.
Agency sponsor review: Submit your FIPS 199 categorization to your agency sponsor for written approval. If they disagree with your assessment, you'll know before you invest months in the wrong control set.
Peer review against similar systems: Look at FedRAMP Marketplace listings for systems with similar functionality. If comparable services are authorized at Moderate and you're claiming Low, revisit your categorization. Market precedent isn't definitive, but it's a useful sanity check.
Control applicability test: Scan the baseline control set. If you're seeing controls that make no sense for your architecture (for example, physical access controls when you're a pure SaaS provider using an already-authorized infrastructure), you might be at the wrong baseline, or you need to document control inheritance from your infrastructure provider.
Maintenance and Ongoing Tasks
Baseline categorization isn't static. Maintain it through:
Annual categorization review: NIST SP 800-37 requires periodic review of system categorization. If your system adds new data types, integrates with new agency systems, or expands functionality, reassess your FIPS 199 categorization.
Change request evaluation: Every significant system change should trigger a categorization impact analysis. If you add a new module that processes CUI and your current baseline is Low, you've just triggered a re-categorization.
Continuous monitoring alignment: Your continuous monitoring strategy must match your baseline. Moderate systems require monthly vulnerability scanning and annual assessments. High systems require more frequent scanning and enhanced monitoring. If your monitoring program doesn't align with your baseline, you're out of compliance.
Agency requirement updates: Federal agencies periodically revise their authorization requirements. Monitor your agency sponsor's guidance for baseline changes that might affect your system.
Baseline selection determines whether your FedRAMP authorization costs $300,000 or $1.2 million, whether it takes 12 months or 24. Get it right at the start, document it thoroughly, and revisit it when your system evolves. Everything else in your authorization process flows from this decision.
