FedRAMP Moderate

The full NIST SP 800-53 Rev 5 Moderate baseline across all 19 control families, with the verbatim public-domain control text.

What FedRAMP Moderate is

FedRAMP is the US government's authorisation programme for cloud services. A cloud service provider selling to federal agencies needs an Authority to Operate, and the Moderate baseline — appropriate where a loss of confidentiality, integrity or availability would have a serious adverse effect — is where the overwhelming majority of commercial FedRAMP work happens.

The Moderate baseline is drawn from NIST SP 800-53 Rev 5, spanning all nineteen control families from Access Control through to Program Management, including the control enhancements the baseline selects. It is by a wide margin the largest control set in this catalogue, and that is not incidental: the volume is the reason FedRAMP programmes fail, and the reason they need tooling rather than a spreadsheet.

One naming point worth being exact about, because vendors are routinely sloppy here: NIST SP 800-53 is a control catalogue, not a compliance framework you can be assessed against. What organisations are actually assessed against is a baseline drawn from it. CMDash does not list "NIST 800-53" as a framework for that reason — what ships is FedRAMP Moderate, and it carries the 800-53 Rev 5 Moderate baseline.

Who it applies to

• Cloud service providers pursuing a FedRAMP authorisation, whether through an agency sponsor or the JAB.
• Organisations with a StateRAMP or agency-specific requirement derived from the same baseline.
• Anyone who has been asked for "800-53 Moderate" and needs the actual control set rather than the catalogue.
• Federal contractors who need 800-53 control language to satisfy a flow-down requirement.

How it is structured in CMDash

CMDash seeds the Moderate baseline across all nineteen control families, expanding control enhancements into their own rows so that evidence attaches per enhancement rather than being lumped under the base control — the same convention used for TISAX sub-controls.

The control text

What CMDash does for FedRAMP Moderate

• Verbatim NIST SP 800-53 Rev 5 control text on very nearly the entire baseline, taken from the OSCAL catalogue. 800-53 is public-domain US-government content, so the real control language is in the product rather than a paraphrase.
• A FedRAMP-format POA&M export with the extended columns — POA&M identifier, weakness description, risk level, point of contact, resources required, scheduled completion date, milestones and source of finding.
• Seeded crosswalks to NIST CSF, HITRUST CSF and TISAX, which matters more here than elsewhere: an organisation that has done FedRAMP has done an enormous amount of work, and the crosswalks are how it gets reused.
• A read-only, time-boxed assessor seat scoped to FedRAMP, which is the practical answer to giving a 3PAO access without handing out a shared login.
• An evidence package export — a ZIP with a manifest, the files and data snapshots — for the volume of artefacts a FedRAMP assessment demands.

What it shares with your other frameworks

CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.

Where the evidence comes from

CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to FedRAMP Moderate’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.

All 47 integrations →

Where CMDash stops

Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.

• Moderate only. The High and Low baselines are not seeded, and neither is FedRAMP Tailored / Li-SaaS.
• A small number of baseline rows do not have verbatim text attached; those carry the identifier, title and evidence guidance and leave the full text empty rather than substituting synthesised wording.
• CMDash does not produce the OSCAL SSP package that FedRAMP submission requires, and it is not a 3PAO. It tracks the controls, the evidence and the gaps.
• The generated System Security Plan carries the same labelled "contractor action required" placeholders for system description, boundary and governance as the CMMC one.

Common questions

Also in Government & Defense

Paid plans cap how many frameworks you run at once, never which ones — FedRAMP Moderate is available on every paid plan.