FedRAMP has four impact levels: Li-SaaS (Low-Impact SaaS) with ~37 controls for simple SaaS applications, Low with 125 controls for public information systems, Moderate with 323 controls for most civilian agency systems (80% of authorizations), and High with 410 controls for national security and critical infrastructure systems.