U.S. FedRAMP Rev. 5 (Moderate Impact Baseline)

Why does it matter?

Moderate is the level at which most federal cloud use happens, from collaboration suites to case-management systems, so the Moderate baseline is the control set most providers, assessors and agency authorizing officials work with. Its size, its FedRAMP parameters and the way the 2026 rules are changing it decide how much engineering and evidence a Rev5 Class C certification needs.

Key benefits include:

• A defined threshold

FIPS 199 Moderate means a loss of confidentiality, integrity or availability would cause a serious adverse effect, such as significant operational damage, financial loss or individual harm short of loss of life.

• 323 named controls

The baseline lists 181 base controls and 142 enhancements, from AC-1 to SR-12, so scope is settled before an assessment begins.

• Parameters written down

FedRAMP-defined assignments such as the quarterly privileged-account review in AC-2(j) remove guesswork at Moderate; the 2026 rules replace most of them with provider-set values recorded in the Security Decision Record.

• The largest market

Nearly 80 percent of certified services are Moderate, so most agency reuse under 44 U.S.C. 3613 happens with this baseline.

• A shared repository

Moderate (like Low) packages and monthly deliverables go to FedRAMP's secure repository, where every customer agency can review them.

How does it work?

The provider starts with the FIPS 199 categorization template in the SSP and, for Moderate, the FedRAMP Moderate Readiness Assessment Report if it wants FedRAMP Ready status first. It implements the 323 controls, writes the implementation statement for each in SSP Appendix A (Moderate) and the Customer Responsibility Matrix, and records cryptographic modules in Appendix Q, where FIPS 140-validated modules are required wherever cryptography protects federal data.

A FedRAMP-recognized 3PAO prepares the Security Assessment Plan, tests every control, and reports in the Security Assessment Report with the Moderate Security Requirements Traceability Matrix and the Risk Exposure Table. The sponsoring agency's authorizing official issues the ATO, the provider submits the Initial Authorization Package Checklist, and FedRAMP's review team checks the package before the Marketplace lists the service as FedRAMP Certified with type Rev5, path Agency and Class C.

Ongoing certification follows the Rev5 rulesets: Collaborative Continuous Monitoring, Vulnerability Detection and Response, Vulnerability Evaluation and Reporting, Incident Evaluation and Communication, Significant Change Notification and Cryptographic Module Use. Monthly inventory and POA&M updates (CM-8) and scan reports (RA-5) continue, CA-2 requires an independent assessment at least annually, and from January 1, 2027 Moderate offerings must apply the 2026 rules at their first completed assessment.

Key Elements

• Family distribution

The 323 controls fall across 18 families, the largest being Access Control (43), System and Communications Protection (29), Configuration Management (27), Identification and Authentication (27), System and Information Integrity (24) and Contingency Planning (23).

• FedRAMP parameters and additional requirements

Columns in the baseline that set Moderate-specific values and FedRAMP-only expectations, for example the three-year policy review cycle in AC-1 and the quarterly privileged-account review in AC-2(j).

• Continuous monitoring periodicity

Each control carries the frequency at which evidence must be refreshed, feeding the monthly deliverables, the annual assessment controls selection worksheet and the Continuous Monitoring Monthly Executive Summary.

• Class C under the 2026 rules

Class C provides adequate assurance for most Low and Moderate security objectives and some High objectives; Rev5 Class C generally requires an agency sponsor, with limited temporary Program pipelines that opened August 10, 2026.

• Security Decision Record

The persistently maintained, verified and validated record of security decisions required by the 2026 package rulesets, which holds the organization-defined parameter values that FedRAMP used to assign.

• Secure repository and reuse

Moderate packages live in FedRAMP's repository so agencies can review the ATO, SAR and monthly materials and reuse them, as 44 U.S.C. 3613 requires.

What does it cover?

The Moderate baseline applies to cloud service offerings, whether IaaS, PaaS or SaaS, that hold federal information categorized Moderate under FIPS 199, to the 3PAOs that assess them and to the agencies that authorize and reuse them. It is the reference baseline for Rev5 Class C, and the DoD Cloud Computing Security Requirements Guide builds its Impact Level 2 and 4 expectations on FedRAMP Moderate. It is not the baseline for systems that hold High-impact data such as law enforcement, emergency services or health systems.

What are its objectives?

The Moderate baseline fixes what adequate security means for the bulk of federal cloud services.

Select one agreed set of NIST SP 800-53 Rev. 5 controls for Moderate-impact cloud services so that every assessment tests the same scope.

State the FedRAMP parameters and additional requirements that NIST leaves to the organization.

Give assessors a traceable test plan through the Moderate Security Requirements Traceability Matrix.

Keep certified services under monthly and annual monitoring that every customer agency can review.

Carry Moderate offerings into the Consolidated Rules for 2026 and, in time, FedRAMP 20x Class C.

Framework in Context

The Moderate baseline sits between the Low baseline (156 controls) and the High baseline (410 controls) and is derived from the NIST SP 800-53B Moderate baseline with FedRAMP additions. It operates under FISMA (44 U.S.C. 3554) and the FedRAMP Authorization Act, and the Consolidated Rules for 2026 relabel it Class C while FedRAMP 20x Class C replaces its documented plans with Key Security Indicators. The legacy Moderate templates were marked legacy on June 23, 2026.

Common Framework Mappings

FedRAMP Rev. 5 (Moderate Impact Baseline) is often mapped to other leading security and privacy frameworks to simplify cloud service compliance, reduce audit duplication, and meet overlapping federal and industry requirements.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

GDPR

HIPAA

ISO 27001:2022

ISO 27017

ISO 27018

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1