Question 1

What are the different FedRAMP impact levels?

Accepted Answer

FedRAMP has four impact levels: Li-SaaS (Low-Impact SaaS) with ~37 controls for simple SaaS applications, Low with 125 controls for public information systems, Moderate with 323 controls for most civilian agency systems (80% of authorizations), and High with 410 controls for national security and critical infrastructure systems.

Question 2

How do I determine my FedRAMP impact level?

Accepted Answer

Your FedRAMP impact level is determined using FIPS 199 security categorization. You assess the potential impact (Low, Moderate, or High) of a security breach on three objectives: Confidentiality, Integrity, and Availability. The highest impact across these objectives determines your overall impact level using the 'high water mark' principle.

Question 3

What is FedRAMP Li-SaaS and who qualifies?

Accepted Answer

FedRAMP Tailored Li-SaaS (Low-Impact SaaS) is a streamlined authorization path for low-risk SaaS applications. To qualify, your service must be SaaS, hosted on FedRAMP-authorized infrastructure, have low security impact, and store no PII beyond login credentials. It requires only ~37 controls and no 3PAO assessment.

Question 4

What is the difference between FedRAMP Moderate and High?

Accepted Answer

FedRAMP Moderate (323 controls) is for systems where a breach would cause serious but not catastrophic harm - most SaaS/PaaS serving civilian agencies. FedRAMP High (410 controls) is for systems where a breach could threaten national security, endanger lives, or impact critical infrastructure - required for DoD and intelligence agencies.

Question 5

How long does FedRAMP authorization take?

Accepted Answer

Timeline varies by impact level: Li-SaaS typically takes 3-6 months, Low takes 6-12 months, Moderate takes 9-15 months, and High takes 12-18 months. Factors affecting timeline include your current security posture, documentation readiness, 3PAO availability, and sponsoring agency responsiveness.