FedRAMP Moderate Baseline Controls

FedRAMP Moderate is the most common impact level for cloud services. It applies to systems where loss of confidentiality, integrity, or availability would have serious effects on agency operations, organizational assets, or individuals (but not catastrophic effects, which would be High).

The Moderate baseline includes 325 controls drawn from NIST SP 800-53 Rev 5. The controls span 20 families covering access control, audit, cryptography, incident response, system integrity, and more. Each control may have multiple sub-controls (control enhancements).

FedRAMP layers two additional requirements on top of NIST 800-53:

• FedRAMP parameter values: Many controls have configurable parameters (e.g., audit retention period). FedRAMP specifies required values, often more stringent than NIST defaults.
• FedRAMP-specific guidance: Implementation guidance for cloud-specific scenarios

Refer to the FedRAMP framework reference for the impact level definitions and authorization paths.

Controls are organized into 20 families. Some are larger than others. The largest:

• System and Communications Protection (SC): 33 controls covering boundary protection, cryptographic protection, network security
• Access Control (AC): 25 controls covering account management, separation of duties, least privilege, remote access
• Audit and Accountability (AU): 14 controls covering log generation, retention, review, protection
• System and Information Integrity (SI): 17 controls covering flaw remediation, malware protection, monitoring, alerts
• Configuration Management (CM): 14 controls covering baselines, change control, software inventory
• Identification and Authentication (IA): 12 controls covering MFA, identity proofing, authenticator management

Smaller families (Personnel Security, Awareness and Training, Physical Protection) typically inherit from cloud provider for IaaS-hosted services. Document the inheritance carefully in the SSP.

NIST 800-53 controls often have organization-defined parameters: "the organization defines audit retention period" or "the organization defines password complexity." FedRAMP specifies required values for these parameters.

Common FedRAMP parameter values:

• AC-2(3) Inactive accounts disabled: 90 days (some controls require 35 days for high-privilege)
• AU-11 Audit record retention: 90 days online, 12 months offline minimum
• IA-5(1) Password complexity: Minimum 12 characters, complexity requirements per FedRAMP guidance
• CM-3 Configuration change control: Authorized in advance for moderate-impact systems
• CP-9 System backup: Daily incremental, weekly full backups, tested annually

FedRAMP publishes a parameter values spreadsheet that lists every control with FedRAMP-specified parameters. Use this spreadsheet to populate your SSP. Deviations from FedRAMP parameter values require justification and may require waiver requests.

Some controls consume disproportionate implementation effort. Plan accordingly:

• SC-13 Cryptographic protection: Every cryptographic module in scope must be FIPS 140-2 (or 140-3) validated. Migrating from non-validated modules to validated ones often requires re-architecting services.
• SC-7 Boundary protection: Network segmentation, deny-by-default firewall rules, intrusion detection at boundaries. Requires careful network architecture.
• AU-2 to AU-12 Audit family: Comprehensive logging across all in-scope systems with centralized aggregation, retention, and review.
• IA-2(1) MFA for privileged accounts: PIV/CAC card support is the highest bar. Username/password/TOTP combinations may meet FedRAMP at Moderate but PIV-aligned authenticators are increasingly expected.
• CP-2 Contingency plan and CP-9 Backup: Documented recovery procedures with annual testing and exercises.
• IR-3 Incident response testing: Tabletop exercises with documented results.

Budget 60-70% of implementation effort to these six control areas. The other 14 families are lower-effort once you have the security operations foundation.

If your service runs on an authorized cloud provider (AWS GovCloud, Azure Government, Google Cloud Government), you inherit some controls from the provider. The Customer Responsibility Matrix (CRM) documents which controls are:

• Inherited entirely: Provider implements; you reference
• Inherited partially: Provider implements at infrastructure layer; you implement at application layer
• Customer-implemented: You implement entirely; provider has no role
• Shared: Both provider and you have specific responsibilities

Inheritance reduces implementation effort but adds documentation burden. Each inherited control needs:

• Reference to the provider's authorization (P-ATO or ATO)
• Citation of provider's CRM section
• Description of what you implement (if any) on top of provider's implementation
• Evidence the provider's implementation continues to operate

Cloud provider agreements typically include access to their FedRAMP audit reports under NDA. Reference those reports in your SSP for inherited controls.