U.S. FedRAMP Rev. 5 (LI-SaaS Baseline)

Why does it matter?

LI-SaaS exists because many SaaS tools agencies want hold little federal data and run on infrastructure that already carries a FedRAMP authorization. Repeating a full Low assessment for each one is wasteful, so FedRAMP cut the documentation to one appendix and let providers attest to most controls. Knowing exactly which of the 156 controls fall in each tailoring category is what makes the path short.

Key benefits include:

• Eligibility is precise

A SaaS qualifies only if it is FIPS 199 Low and stores no personal information beyond username, password and email address; anything more means the full Low baseline.

• Most controls are attested

75 of the 156 controls carry the Attest action: the control must exist, but the provider confirms it in Appendix E with no documentation or independent test.

• Fewer tested controls

45 controls are Document and Assess and 20 more are conditional, so the 3PAO tests roughly a third of the Low list rather than all of it.

• Inheritance is allowed

Controls inherited from a FedRAMP-authorized IaaS or PaaS need only an attestation, though a 3PAO must validate that they can be inherited.

• A consolidated package

Appendix A for LI-SaaS combines the SSP control statements, the assessment procedures and the results, and several SSP appendices are not required at all.

How does it work?

The provider first confirms the Low categorization and the no-PII-beyond-login condition, then works through the LI-SaaS baseline worksheet. Each of the 156 controls is marked FED (a federal responsibility, 3 controls), NSO (not security-relevant for a SaaS, 11), Document and Assess (45), Document and Assess Conditional (20), Inherited, or Attest (75). Two controls carry a split action. If a provider supplies its own underlying infrastructure, some attested controls become required.

The provider writes the control statements for the Document and Assess controls in Appendix A and completes the Appendix E self-attestation table for every attested control, including conditional controls whose condition does not exist. A FedRAMP-recognized 3PAO then assesses the documented controls, records results in the same appendix, and validates inherited features; FedRAMP recommends summarizing residual risk in the Risk Exposure Table so agency reviewers see it in one place.

The sponsoring agency's authorizing official issues the ATO, the package goes to FedRAMP's secure repository, and the service is listed as FedRAMP Certified. Monthly continuous monitoring deliverables follow the same cadence as Low, posted to the FedRAMP repository. Under the Consolidated Rules for 2026 the templates are legacy: new Rev5 applications from January 1, 2027 follow the 2026 rulesets, Class B replaces the LI-SaaS and Low labels, and the SSP gives way to a Certification Package Overview and Security Decision Record.

Key Elements

• Six tailoring categories

FED, NSO, Document and Assess, Document and Assess Conditional, Inherited and Attest, defined in Table A-1 of SSP Appendix A for LI-SaaS and applied control by control in Table A-2.

• Attested controls (75)

Policy-level controls such as AC-1 (Policy and Procedures) where the provider confirms existence in the Appendix E self-attestation statement.

• Documented and assessed controls (45)

Technical controls such as AC-2 (Account Management) that must be described and independently tested, with risks recorded where the intent is not fully met.

• Family coverage

The 156 controls span 18 families, the largest being Identification and Authentication (16), System and Communications Protection (14), Access Control (11) and Supply Chain Risk Management (11).

• Cryptography expectation

Appendix Q documents encryption status; for Low and LI-SaaS, FIPS 140-validated modules are mandatory only for the MFA verifier, with other encryption documented where implemented.

• Class B under the 2026 rules

Class B provides adequate assurance for most Low security objectives; 20x Class B is a Program Certification with no sponsor, while Rev5 Class B generally needs an agency, with temporary Program pipelines that opened August 10, 2026.

What does it cover?

LI-SaaS applies to Software as a Service offerings used by U.S. federal agencies that are categorized Low under FIPS 199 and hold no personal information beyond login credentials, typically running on a FedRAMP-authorized IaaS or PaaS. It applies to the 3PAOs that assess them and the agencies that authorize them. It does not apply to IaaS or PaaS offerings, to SaaS that stores other PII, or to any Moderate or High system; those use the standard Low, Moderate or High baselines.

What are its objectives?

LI-SaaS reduces the FedRAMP burden for the lowest-risk SaaS without dropping below the Low baseline.

Keep all 156 Low baseline controls in scope while fixing which must be tested and which may be attested.

Consolidate the SSP, assessment plan and results for the service into one Appendix A document.

Let providers inherit controls from FedRAMP-authorized infrastructure with 3PAO validation.

Give agencies a single self-attestation statement and residual-risk table to review.

Carry low-impact SaaS into Class B under the Consolidated Rules for 2026 and FedRAMP 20x.

Framework in Context

LI-SaaS is a tailoring of the FedRAMP Low baseline, itself selected from the NIST SP 800-53 Rev. 5 catalog, and it operates under FISMA (44 U.S.C. 3554) and the FedRAMP Authorization Act (44 U.S.C. 3607 to 3616). GSA first announced FedRAMP Tailored in 2017 under the Rev. 4 baselines; the Rev5 version dates from 2023. The 2026 rules fold it into Class B, and FedRAMP 20x Class B, piloted in 2025, replaces its documented plans with Key Security Indicators.

Common Framework Mappings

FedRAMP Rev. 5 (LI-SaaS Baseline) is often mapped to other government and industry security frameworks to simplify risk management, simplify compliance efforts, and facilitate multi-framework reporting for cloud service providers.

Mapped frameworks include:

CIS Controls v8.1

CSA CCM v4

HIPAA (NIST SP 800-66 Rev. 2)

ISO 27001:2022

ISO 27017

ISO 27018

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1