Prepare for FedRAMP Moderate with evidence that collects itself

The FedRAMP Moderate baseline is the set of 323 NIST SP 800-53 Rev. 5 controls and enhancements that a cloud service must implement to be used for moderate-impact US federal information. FedRAMP tailors the NIST controls with its own parameters, such as review frequencies, and additional requirements. It covers 18 control families, including access control, incident response, configuration management and supply chain risk management.

FedRAMP Rev. 5 Moderate contains 323 controls and enhancements drawn from NIST SP 800-53 Rev. 5, across 18 control families. Access Control is the largest family with 43, followed by System and Communications Protection with 29. For comparison, the FedRAMP Low baseline has 156 and the High baseline has 410, according to FedRAMP's security controls baseline workbook.

Cloud service providers need FedRAMP Moderate when a US federal agency wants to use their service for information categorised as moderate impact under FIPS 199. This covers most agency use cases involving sensitive but unclassified data. Providers usually pursue it because an agency customer requires it, as FedRAMP advises against going straight to this level without an existing federal contract.

FedRAMP 20x is replacing the Rev. 5 process. Under the Consolidated Rules for 2026, the 20x Class C Certification covers most Moderate use cases, and its application pipeline opened on 31 August 2026. FedRAMP will stop accepting new Rev. 5 Certification applications on 11 June 2027. Existing Rev. 5 Moderate providers must follow the Consolidated Rules, which become mandatory on 1 January 2027.

There are no fines, but a cloud service without the required FedRAMP Certification generally cannot be used by federal agencies for moderate-impact information. FedRAMP is required by the FedRAMP Authorization Act and OMB policy for agency use of cloud services. Certified providers that fail continuous monitoring obligations can face corrective action and risk losing their certification.

FedRAMP Moderate is far more prescriptive than ISO 27001 or SOC 2, specifying 323 controls with fixed parameters rather than letting you choose controls through risk assessment. Many controls overlap, so an existing ISO 27001 or SOC 2 programme gives a strong starting point. FedRAMP does not accept either as a substitute for its own independent assessment.

It depends on how mature your security programme is and how quickly your agency sponsor and assessor move. Preparation, implementing the 323 controls, independent assessment and agency review together often take many months. Automating evidence collection and mapping existing ISO 27001 or SOC 2 controls shortens the preparation stage, but it does not remove the assessment and review steps.

Yes, on request. FedRAMP Rev. 5 Moderate is mapped in OneClickComply's control library and available on request, rather than live as a standard framework today. We help you map controls, collect evidence, generate policies and monitor drift. OneClickComply does not issue FedRAMP certifications: certification follows an independent assessment and FedRAMP review.