FedRAMP Rev 5
Authorization process (CSP Authorization Playbook volume I: partners, categorization, preparation, assessment, agency ATO and FedRAMP review, reuse) – FedRAMP Rev 5

FedRAMP Rev 5 A.2: A.2 Impact level categorization

Providers categorize their offering under FIPS 199 into Low, Moderate or High across confidentiality, integrity and availability, using the FIPS 199 categorization template in SSP Appendix K with NIST SP 800-60 volume 2, and select the matching baseline, with LI-SaaS available for low-impact SaaS holding no PII beyond login credentials and Moderate covering nearly 80 percent of authorized services; the categorization precedes agency partnership and is confirmed with the agency, because the security impact level is ultimately determined by the federal agency customer, whose AO has its own risk tolerance, and the provider coordinates to agree it.

Maintained by Gerard BlokdykControl text last updated

Other controls in Authorization process (CSP Authorization Playbook volume I: partners, categorization, preparation, assessment, agency ATO and FedRAMP review, reuse) – FedRAMP Rev 5

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FedRAMP Rev 5 controls