Impact Levels — choosing Low / Moderate / High

Field	Value
Type	Skill Resource
Source	~/.copilot/skills/security/references/ato/impact-levels.md
Description	Not specified

Source Content

Impact Levels — choosing Low / Moderate / High

The impact level is set by the data, not chosen by preference. It comes from a FIPS 199 categorization and decides which NIST 800-53 baseline applies. Source docs: docs/compliance/ato/security/fedramp.mdx, nist-800-53.mdx, stateramp-and-dod-impact-levels.mdx.

FIPS 199 categorization — the worksheet

Categorize the system against three security objectives, then take the high-water mark (the single highest of the three sets the whole system’s level).

Objective	Ask	Low	Moderate	High
Confidentiality	What if this data leaked?	Limited harm	Serious harm	Severe / catastrophic harm
Integrity	What if it were altered without authorization?	Limited harm	Serious harm	Severe / catastrophic harm
Availability	What if it were unavailable?	Limited harm	Serious harm	Severe / catastrophic harm

The overall category is {Low | Moderate | High} = the maximum across the three rows. One High objective makes the whole system High, regardless of the other two.

What each level costs (control count)

Level	Breach impact	NIST 800-53 Rev 5 controls (approx.)	Where it lands
Low	Limited adverse effect	~156	Public / low-sensitivity data
Li-SaaS	Low-impact SaaS (tailored Low)	~156 (tailored subset)	Simple low-risk SaaS apps
Moderate	Serious adverse effect	~323	Most federal and gov data — general PII, typical gov SaaS
High	Severe or catastrophic effect	~410	Law enforcement, health, financial, emergency services

Counts are from the FedRAMP Rev 5 baselines (released 2023-05-30). They shift as families are revised by RFC — verify on fedramp.gov/rev5-transition. High has more controls than Moderate largely because it pulls in more enhancements of the same base controls, not entirely different controls.

Platform strategy — build to High, dial down by profile

The platform targets FedRAMP High as the master baseline and selects the active control set with a profile rather than a fork:

fedramp-high      → full High module set, IAL3 / AAL3 / FAL3
fedramp-moderate  → Moderate module set (the common gov-SaaS floor)
fedramp-low       → Low / Li-SaaS subset

Rationale (from frd-fedramp-compliant-platform.mdx): High is a superset of SOC 2, ISO 27001, StateRAMP/GovRAMP, and CMMC L2, so building the hardest baseline once lets you map down with evidence reuse instead of re-architecting. Assurance level is configuration, not a code fork (NFR-02).

Decision shortcut

• Don’t know the level yet? Assume Moderate and flag any data type that would force High (law-enforcement, health, financial, emergency-services, or anything where loss is “severe or catastrophic”).
• Selling to US federal agencies, in the cloud? FedRAMP, level by FIPS 199.
• Selling to US state/local government? StateRAMP / GovRAMP — same Low/Mod/High baselines, reuses FedRAMP work.
• DoD workload? Map to a DoD Impact Level (below); FedRAMP High is the prerequisite for IL5/IL6.

Adjacent regimes (same NIST foundation)

StateRAMP / GovRAMP

The state-and-local-government analog of FedRAMP (rebranded GovRAMP in 2025). Uses NIST 800-53-based Low / Moderate / High baselines mirroring FedRAMP and honors FedRAMP reciprocity, so an existing FedRAMP authorization can be recognized. For a builder already on the FedRAMP baseline it is largely a packaging and submission exercise.

DoD Cloud Computing Impact Levels (IL2–IL6)

The DoD overlay (per the DoD Cloud Computing SRG) layering additional controls on top of FedRAMP for defense workloads.

Level	Data	Baseline
IL2	Public / non-critical unclassified	≈ FedRAMP Moderate
IL4	CUI / non-critical mission data	FedRAMP Moderate + DoD controls
IL5	Higher-sensitivity CUI & unclassified NSS	FedRAMP High / IL4 + stricter separation
IL6	Classified up to SECRET	FedRAMP High + controls, on SIPRNet

(IL1 and IL3 are retired.) IL5/IL6 add separation, US-person, and facility requirements beyond software — note them, but they are infra/organizational, not app code.

Data residency note (High / IL5)

Sensitive deployments generally require US-only data residency handled by US persons — typically a dedicated GovCloud boundary separate from the commercial offering. This is a deployment/hosting control, not application code; flag it when the target is High or IL5+.

Sources

Claim	Source
Impact levels, baselines, control counts, ConMon	docs/compliance/ato/security/fedramp.mdx · fedramp.gov
FIPS 199 high-water-mark categorization	NIST FIPS 199
800-53B baselines (Low/Mod/High)	NIST SP 800-53B
StateRAMP/GovRAMP, DoD ILs	docs/compliance/ato/security/stateramp-and-dod-impact-levels.mdx
Build-to-High profile strategy	docs/product/roadmap/frd-fedramp-compliant-platform.mdx