FedRAMP Moderate applies to federal systems where a loss of confidentiality, integrity, or availability could cause a serious adverse effect. FedRAMP High applies where that effect could be severe or catastrophic. For file sharing, the appropriate level is driven by the agency’s system categorization, the information being handled, and its mission impact.
In 2026, there is another important consideration for federal buyers: FedRAMP is transitioning from the familiar Low, Moderate, and High terminology to Certification Classes A–D. For Rev5 certification packages, Class C is associated with Moderate and Class D with High. Buyers therefore need to understand both the established FedRAMP levels and the new certification terminology when evaluating cloud services.
FedRAMP High vs. Moderate at a glance
The main difference between FedRAMP Moderate and High is the potential impact of a security failure. Moderate supports many common sensitive federal workloads, while High is intended for environments where compromise or disruption could have significantly greater consequences.
| |
FedRAMP Low |
FedRAMP Moderate |
FedRAMP High |
| Current Marketplace Designation |
Class B (Low) |
Class C (Moderate) |
Class D (High) |
| FIPS 199 Impact if Compromised |
Limited adverse effect |
Serious adverse effect |
Severe or catastrophic adverse effect |
| Typical Use |
Lower-impact federal workloads |
May include CUI, PII, and routine sensitive agency information, depending on system categorization |
May include high-impact defense, law-enforcement, emergency-response, or critical-infrastructure workloads |
| Rev5 Baseline Controls |
156 |
323 |
410 |
| Marketplace Footprint |
Smaller |
Largest category |
More specialized |
| File Sharing Implication |
Often insufficient for sensitive agency workloads |
Appropriate for many agency collaboration and CUI use cases |
Appropriate where the system or mission requires High-impact protection and assurance |
FedRAMP Certification Classes
Certification Classes describe the FedRAMP certification package. They do not replace an agency’s responsibility to categorize its own information system under FIPS 199. Class A is a separate entry-level certification class that replaces FedRAMP Ready (rather than simply a rename of FedRAMP Low).
FedRAMP’s published Rev5 material identifies 156 controls for Low, 323 for Moderate, and 410 for High. These FedRAMP baselines help illustrate the difference in assurance between the three legacy impact categories, although control counts alone do not explain what those differences mean in practice.
What FedRAMP Moderate Covers
FedRAMP Moderate supports systems where compromise could have a serious adverse effect on organizational operations, assets, or individuals.
A Moderate-impact system has at least one confidentiality, integrity, or availability objective rated Moderate, with none rated High. CUI and PII are commonly handled in Moderate environments, but CUI alone does not automatically determine a civilian agency system’s FIPS 199 categorization. The system owner still needs to assess the information involved and the consequences of compromise.
For DoD contractors, additional requirements apply when an external cloud service stores, processes, or transmits covered defense information. Depending on the contract and use case, the service may need to meet the relevant FedRAMP Moderate requirements or approved Moderate-equivalency requirements.
When FedRAMP Moderate is Enough for File Sharing
Moderate may be appropriate when an agency or contractor needs to exchange CUI, PII, procurement records, case files, or similar sensitive material and the system’s FIPS 199 assessment does not produce a High rating.
The determining question: What would the impact be if this information were disclosed, altered, or unavailable?
What FedRAMP High covers
FedRAMP High supports systems where the consequences of compromise could be severe or catastrophic.
A High-impact system has at least one confidentiality, integrity, or availability objective rated High. High-impact requirements are more likely in mission-critical defense, law-enforcement, emergency-response, and critical-infrastructure environments.
ITAR-controlled information can also create stringent handling and access requirements, but ITAR itself is not a FedRAMP impact rating. For requirements specific to defense-related technical data, see FileCloud’s ITAR-compliant file sharing guidance.
When You Need FedRAMP High for File Sharing
If the system categorization produces a High rating, a Moderate-only cloud offering should not be assumed to meet the requirement. The relevant agency or authorizing official ultimately determines the certification evidence needed for the system and mission. When assessing FedRAMP High requirements, buyers should therefore evaluate both the provider’s certification package and the scope of the environment covered by it.
How FedRAMP High and Moderate Differ in Practice
The difference between 323 and 410 Rev5 controls tells only part of the story. For buyers, the more useful distinction is what the additional depth of High means for the platform that will store, access, and move sensitive files.
- Contingency and recovery: Review backup architecture, restore procedures, recovery objectives, and testing. For high-impact workloads, maintaining operations and recovering securely after disruption become particularly important.
- Audit and accountability: Do not stop at confirming that a platform has audit logs. Check which user, administrator, sharing, and file events are recorded, how those records are protected, how long they can be retained, and whether they can be exported to a SIEM.
- System and information integrity: Examine continuous monitoring, vulnerability management, malware protection, and file-scanning controls. For external collaboration, determine how malicious or inappropriate content is identified before it can move further through the organization.
- Identification and authentication: MFA is only part of the picture. Federal deployments may also require PIV/CAC support, role-based access, least privilege, and stronger controls around privileged accounts.
- Cryptographic protection: FedRAMP’s 2026 rules require Class D providers to actively use NIST-validated cryptographic modules when cryptography protects federal customer data. Applicable Class C requirements should likewise be assessed against the current FedRAMP rules and implementation.
The key procurement point is that these capabilities should be evaluated within the actual FedRAMP certification boundary, rather than inferred from a vendor’s general product feature list.
How to Work Out Which FedRAMP Level You Need
Determining the appropriate level requires an assessment of the information types involved and the potential impact of a loss of confidentiality, integrity, or availability.
- Inventory the information types the environment will store, process, or transmit.
- Assess the potential impact of losing confidentiality, integrity, and availability for each information type.
- Apply the FIPS 199 high-water-mark rule by taking the highest applicable impact value for each security objective.
- Confirm the resulting system categorization with the appropriate agency or authorizing official.
- Shortlist cloud services whose FedRAMP certification packages provide the evidence your authorization process requires.
A single High rating for confidentiality, integrity, or availability makes the overall information system High impact. A cloud provider can explain its certification, controls, and authorization boundary, but the impact category itself is determined through the agency’s system categorization process.
What the 2026 FedRAMP Certification Classes Mean for Buyers
FedRAMP’s Consolidated Rules for 2026 introduce Certification Classes A–D and standardize the use of FedRAMP Certification terminology. For Rev5 offerings, Classes B, C, and D are associated with the certification packages for legacy Low, Moderate, and High requirements.
This terminology change is significant for procurement teams.
Older documentation and vendor materials may still refer to FedRAMP authorization levels, while newer materials increasingly use terms such as FedRAMP Certification Classes or FedRAMP certification levels. The important distinction is that Certification Classes describe the certification package. Agencies still categorize their information systems according to impact.
FedRAMP opened optional adoption of the Consolidated Rules on July 4, 2026. Mandatory adoption begins January 1, 2027, and FedRAMP states that applications for new Rev5 certifications will stop being accepted after June 11, 2027. During the transition, an RFP should ask vendors for their current FedRAMP Marketplace listing, Certification Class, certification type and path, and authorization boundary rather than relying on a broad statement that a service is “FedRAMP compliant.”
FedRAMP Certification also does not replace an agency ATO. The agency authorizing official still decides whether a system can be used for the agency’s specific mission and environment.
FedRAMP Impact Levels vs. DoD Impact Levels (IL4 and IL5)
FedRAMP impact levels and DoD Impact Levels are related but separate systems. They should not be treated as direct one-to-one equivalents. DoD IL4 supports CUI and other non-public unclassified information within its defined scope. IL5 covers workloads requiring additional protection, including certain unclassified National Security Systems.
A cloud service meeting a FedRAMP baseline does not automatically satisfy every DoD Impact Level requirement. DoD-specific controls, authorization requirements, and the applicable provisional authorization must also be considered. The practical takeaway is straightforward: do not assume Class C automatically means IL4 or Class D automatically means IL5.
What to Check When Evaluating a FedRAMP-certified Platform
A FedRAMP claim should be the starting point for vendor due diligence. There are specific parameters to explore as part of vendor assessment and validation.
| Assessment Parameter |
What to Verify |
| Marketplace status |
Confirm the cloud offering on the official FedRAMP Marketplace. Check its certification status, class, type, path, and current lifecycle phase. |
| Authorization boundary |
Establish exactly which infrastructure, services, storage components, and security capabilities fall inside the assessed environment. For file sharing, this can affect external sharing, file preview, malware scanning, audit logging, and integrations. |
| Hosting or accelerator relationship |
If an application is delivered within another provider’s FedRAMP-certified environment, establish which controls are inherited, how the application sits within that environment, and what is covered by the certification package. |
| Cryptography |
Identify which cryptographic modules protect federal customer data and verify their current validation status rather than relying on a broad “FIPS compliant” claim. |
| Moderate equivalency |
For applicable DoD use cases, FedRAMP Moderate equivalency should not be confused with being FedRAMP Certified at Moderate. Review the assessment evidence and 3PAO requirements applicable to the contract. |
| Agency authorization |
Confirm what additional documentation or evidence the authorizing official requires before issuing an ATO. |
For more information on secure federal content collaboration, see FileCloud’s FedRAMP file sharing guidance.
FileCloud for FedRAMP High / Class D requirements
FileCloud provides a deployment option for organizations with legacy FedRAMP High / current Class D requirements through FedHIVE.
The official FedRAMP Marketplace listing is for Federal High Impact Virtualized Environment (FedHIVE), operated by Human Resources Technologies, Inc. (HRTec). As of August 27, 2026, FedRAMP lists FedHIVE as FedRAMP Certified, Rev5, Class D (High) and in the Ongoing Certification phase.
Buyers should review the FedHIVE Marketplace listing and applicable certification boundary to understand how the FileCloud deployment, infrastructure, and relevant controls are covered within that environment.
FileCloud’s FedRAMP offering is designed to combine secure content collaboration with granular access controls, data governance, classification, DLP, and detailed audit capabilities within a secure environment hosted and managed by FedHIVE. This aligns with FileCloud’s broader government use cases, where secure external sharing, federal compliance, FIPS requirements, large-file exchange, and granular control are recurring customer requirements.
For this FedRAMP deployment, applicable FIPS 140-3 cryptographic validation is provided through the FedHIVE environment. Buyers should confirm the validated implementation and configuration applicable to their specific deployment rather than relying on a general “FIPS compliant” description.
Interested in learning more? →
Explore FileCloud FedRAMP High or read the FileCloud FedRAMP High authorization announcement.
Ready to take the next step? →
Book a demo with our FileCloud FedRAMP expert to explore deployment architecture, certification scope, and security capabilities relevant to your federal file-sharing use case.
FedRAMP High vs. Moderate: Frequently Asked Questions
What are the different levels of FedRAMP?
Legacy Rev5 uses Low, Moderate, and High baselines. Under the 2026 terminology, FedRAMP uses Certification Classes, with Classes B, C, and D associated with legacy Low, Moderate, and High certification packages. Class A is a separate entry-level class replacing FedRAMP Ready.
What does “FedRAMP High” mean?
FedRAMP High traditionally refers to the Rev5 High baseline for cloud services supporting high-impact federal systems. Under the 2026 terminology, High Rev5 certification packages are represented as Class D (High).
Does FedRAMP Moderate require FIPS?
Federal cryptographic requirements depend on the applicable FedRAMP rules, controls, and implementation. Buyers should verify the specific NIST-validated cryptographic modules used within the relevant cloud environment rather than relying on a general claim that a platform is “FIPS compliant.”
Do I need FedRAMP High or Moderate for sharing CUI?
CUI does not automatically mean High. The appropriate requirement depends on system categorization, mission impact, agency requirements, and, for defense contractors, applicable DoD contractual rules. Many CUI cloud use cases use the Moderate baseline, but additional requirements can apply.
How many controls does FedRAMP High require compared with Moderate?
For the Rev5 baselines referenced here, FedRAMP identifies 410 controls for High and 323 for Moderate, a difference of 87. These figures should not be treated as a simple control-count formula for newer FedRAMP 20x certification models.
How does FedRAMP High compare with DoD IL4 and IL5?
They are not direct equivalents. DoD Impact Levels include DoD-specific requirements in addition to relevant federal cloud security baselines. Buyers should verify the cloud provider’s applicable DoD authorization rather than infer IL4 or IL5 eligibility from FedRAMP status alone.
Is FedRAMP Moderate equivalency the same as FedRAMP Moderate Certification?
No. Moderate equivalency can satisfy specific DoD contractual requirements when the required assessment evidence is provided, but it does not make a cloud service FedRAMP Certified.
Does FedRAMP High satisfy CMMC?
No. A FedRAMP-certified cloud service can support an organization’s CMMC obligations, but it does not make the contractor CMMC compliant or certified. CMMC evaluates the contractor’s environment, practices, and relevant service-provider relationships separately. See FileCloud’s CMMC 2.0 compliance guide for more detail.
Product Marketing Manager