Not All FedRAMP Levels Are Equal: Navigating Government Security Standards

The Federal Risk and Authorization Management Program (FedRAMP) helps the government approach security assessment, authorization, and monitoring for cloud products and services.

Agencies need to be aware of the three FedRAMP impact levels that guide compliance and overall government security standards. However, there are several trends occurring right now — like more data repositories moving to the high impact level and an increase in cyberattacks — that are creating an inflection point in this space.

Follow along to learn more about FedRAMP and the trends that impact government agencies’ security standards.

Understanding FedRAMP Impact Levels

FedRAMP categorizes cloud providers into three impact levels and an associated number of security controls. The impact levels are based on the sensitivity of the data they handle and the potential consequences of a security breach. To better understand the differences between low, moderate, and high FedRAMP impact levels, here are some details about each category.

Low Impact

Low impact handles less sensitive data, where the impact of unauthorized access or loss is limited. It has 156 security controls.

Systems on the low impact categorization are often used for websites or applications that have basic security requirements. Think of items like username and email address versus personally identifiable information. The data is either publicly available or is data that, if accessed or lost, would cause minimal harm.

Moderate Impact

Moderate impact secures more sensitive data that has potentially significant impacts on operations or assets. It has 323 security controls.

Systems on the moderate impact categorization are the most common out of all impact levels, and can involve use cases like managing human resources, financial transactions, or internal communication platforms. This impact level includes personally identifiable information or financial data. A breach in these systems can lead to substantial harm to agency assets, financial losses, or non-physical impacts on individuals.

High Impact

High impact protects critical operations and highly sensitive data that could have severe effects on operations, assets, or individuals. It has 416 security controls.

Systems on the high impact categorization are often found in law enforcement, emergency services, financial systems, and health systems. This impact level is designed for the government’s most sensitive unclassified data. Loss of confidentiality, integrity, or availability can have catastrophic adverse effects on organizational operations, organizational assets, or individuals.

Government Security Standards Are Changing

Recent trends have changed how government agencies are altering their approach to security. Let’s take a closer look at two of the most prominent topics.

Data Repositories Are Moving to High

More cloud products are being authorized at the high impact level. The FedRAMP Marketplace is filled with popular products like Microsoft Azure and 365 GCC, Google Services and Workspace, Box, Slack, and dozens more.

Maintaining high impact data throughout its lifecycle ensures the most stringent security protocols remain in place. It eliminates security gaps and adds confidence for any future high-level protections. Also, compliance and audit are simplified.

Simply put, it’s better to keep everything in a FedRAMP High data environment.

Cyber Threats Are Increasing

According to the 2023 Internet Crime Report from the FBI’s Internet Crime Complaint Center (IC3), government facilities were the third most-targeted sector for ransomware.

However, the trend is not limited to ransomware — cyberattacks are on the rise across the board. The Center for Internet Security (CIS) reported increases from the Multi-State Information Sharing and Analysis Center (MS-ISAC) for U.S. state, local, tribal, and territorial government organizations between the first eight months of 2022 and the same timeframe in 2023:

What Does This Mean for Government Agencies?

All signs point to heightened security expectations for government data. As more data repositories move to the FedRAMP High Impact Level and cyber threats continue to increase, agencies are under increasing pressure to adopt solutions that meet the most stringent security standards.

In other words, government agencies can’t afford to compromise. Data integrity and the public’s trust are at stake.

Casepoint is the first data discovery platform to support low, moderate, and high data. In an innovative and scalable end-to-end platform, Casepoint supports litigation, investigations, FOIA, Congressional Inquiries, and more with military-grade security. (In fact, Casepoint was the first software in the industry to be authorized at Department of Defense (DOD) Impact Level 5 (IL5) and the first and only to be authorized at DOD Impact Level 6 (IL6).)

Enhanced security does not increase the price. Also, no extra work is required for IT teams. The data classification process determines the appropriate impact level, so low, moderate, and high data is secured in one place flexibly.