FedRAMP Moderate Baseline Rev 4
ActiveCore framework
Best for: Cloud service providers (CSPs) seeking or maintaining a FedRAMP Authorization to Operate (ATO) at the Moderate impact level to sell services to U.S. federal agencies. Any CSP whose cloud offering handles federal data classified at FIPS 199 Moderate must meet this baseline, covering the majority of federal cloud procurements. Company size is irrelevant; the trigger is the federal contract.
| Mandatory? | Mandatory for CSPs selling to U.S. federal agencies |
|---|---|
| Who validates? | 3PAO (Third Party Assessment Organization). No self-assessment. |
| Renewal | Continuous monitoring; annual assessment |
| Scope | Cloud service offering for federal use (moderate impact) |
| Governing body | U.S. General Services Administration (GSA), FedRAMP Program Management Office (PMO), FedRAMP Moderate Rev 4. Official source |
Get started
Point the module source at the FedRAMP Moderate Baseline Rev 4 endpoint and pin a version range you reviewed:
module "..." {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}fedrampmoderate.compliance.tf lists every FedRAMP Moderate Baseline Rev 4 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Audit Logging and Monitoring | Checks CloudTrail configuration: multi-region enablement, S3 data event logging (read and write), log file validation, KMS encryption of trail logs, CloudWatch Logs integration, log retention periods, and alarm action configuration. | Defining AU-2 auditable events in the SSP, configuring alert thresholds and incident response procedures for CloudWatch alarms, performing AU-6 log review on a defined schedule, and maintaining evidence of log review activities for the 3PAO. |
| Encryption in Transit and at Rest | Covers encryption posture: ACM certificate expiration status, API Gateway SSL certificate usage and cache encryption, and CloudTrail log encryption with a KMS CMK. | Documenting FIPS 140-2 validation status for cryptographic modules in use, defining key management procedures per SC-12, configuring KMS key rotation, and maintaining a cryptographic inventory in the SSP. |
| Network Boundary Protection | Validates WAF association on API Gateway stages and confirms Auto Scaling launch configurations have public IP assignment disabled. | The full authorization boundary definition lives in your SSP, and everything beyond these two checks falls on you: WAF rule tuning, security group and NACL configurations across all VPC resources, and data flow diagrams. |
| Backup and Recovery | Checks that AWS Backup plans meet the 35-day minimum retention requirement and that Auto Scaling groups behind load balancers use health checks for automated instance recovery. | Performing and documenting annual backup restoration tests per CP-9, maintaining a contingency plan (CP-2), conducting contingency plan testing (CP-4), and defining recovery time and recovery point objectives. |
| Secure Configuration Management | Scans CodeBuild project configurations for plaintext sensitive values in environment variables. | Establishing and enforcing baseline configurations per CM-2, managing configuration change control processes (CM-3), defining and monitoring configuration settings (CM-6), and limiting systems to essential functions, ports and software (CM-7). |
Controls by category
67 of 98 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 31 are Mapped only: FedRAMP Moderate Baseline Rev 4 lists them, no compliance.tf module checks them.
Audit and Accountability (AU)
3PAOs verify that audit logging covers all authorization boundary components per AU-2 and AU-3. They check for multi-region CloudTrail coverage, log integrity validation (AU-10), integration with a centralized log management solution (AU-6), and retention periods meeting the FedRAMP requirement of at least one year online and three years total (AU-11). A common finding is missing S3 data event logging, which leaves object-level access unaudited.
Contingency Planning (CP)
The most common CP finding is an untested backup: CP-9(1) requires documented restoration testing within the past year, and many organizations cannot produce the evidence. Beyond that, assessors check backup frequency and retention settings against the SSP, and review whether Auto Scaling health checks are configured to support CP-10 recovery objectives.
| Control | Status |
|---|---|
| Backup plan rules should retain recovery points for at least 35 days | Mapped |
System and Communications Protection, Cryptographic Controls (SC-8, SC-13, SC-28)
Assessors validate that data in transit uses FIPS 140-2 validated cryptographic modules (SC-13) and that data at rest is encrypted with customer-managed keys where applicable (SC-28). Expired or soon-to-expire ACM certificates are flagged as SC-8 findings. Auditors commonly request evidence of KMS key policies and key rotation configurations alongside the encryption settings themselves.
Additional controls (88)
AWS Database Migration Service (1)
| Control | Status |
|---|---|
| DMS replication instances should not be publicly accessible | Enforced |
AWS IAM (9)
AWS KMS (1)
| Control | Status |
|---|---|
| KMS CMK rotation should be enabled | Enforced |
AWS Lambda (4)
Amazon CloudFront (1)
| Control | Status |
|---|---|
| CloudFront distributions should use the recommended TLS security policy | Enforced |
Amazon CloudWatch Logs (1)
| Control | Status |
|---|---|
| Log groups should have encryption at rest enabled | Enforced |
Amazon DynamoDB (1)
| Control | Status |
|---|---|
| DynamoDB tables should have point-in-time recovery enabled | Enforced |
Amazon EBS (1)
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
Amazon EC2 (5)
Amazon ECR (1)
| Control | Status |
|---|---|
| ECR repositories should have image scan on push enabled | Enforced |
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon ElastiCache (1)
Amazon OpenSearch Service (3)
Amazon RDS (14)
Amazon Redshift (7)
Amazon S3 (15)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SageMaker (3)
Amazon VPC (5)
Elastic Load Balancing (8)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST SP 800-171 Rev 2 | High 93% | |
| NIST SP 800-53 Rev 5 | High 93% | |
| HIPAA Omnibus Rule 2013 | High 87% |
Frequently asked questions
Should I pursue FedRAMP Moderate Rev 4 or Rev 5?
Rev 5. The FedRAMP PMO requires all new authorizations to use Rev 5 baselines. Existing Rev 4 ATOs must transition according to the timeline published by the PMO (originally one year from Rev 5 release, with extensions granted case by case). If you hold a Rev 4 ATO and have not started your transition, begin mapping Rev 4 controls to Rev 5 equivalents now. The Rev 5 baseline adds controls in areas like supply chain risk management and privacy.
How long does FedRAMP authorization take and what does it cost?
Typical timelines run 12 to 18 months from initial engagement to ATO, depending on the CSP's existing security posture and authorization path. The JAB (Joint Authorization Board) path is generally longer but produces a provisional ATO reusable across agencies; the agency path moves at the sponsoring agency's pace. Costs vary widely: $1M to $3M is common for initial authorization when accounting for 3PAO assessment fees, remediation, SSP development, and staff time. Annual continuous monitoring adds $500K or more.
What is the difference between FedRAMP Moderate and NIST 800-53 Moderate?
FedRAMP Moderate uses NIST 800-53 as its control catalog but layers on additional requirements: mandatory use of a FedRAMP-accredited 3PAO, specific parameter values (e.g., AU-11 sets at least 90 days of online audit record retention), controls beyond NIST's moderate baseline, continuous monitoring reporting to the FedRAMP PMO, and use of FedRAMP templates for the SSP, SAR, and POA&M. Meeting NIST 800-53 Moderate alone does not satisfy FedRAMP.
How many of the 325 controls can be automated with infrastructure-as-code checks?
Only part of the baseline has technical configurations that automated checks can validate; the controls mapped here are one such set. The remaining controls are procedural, organizational, or require human judgment: personnel security (PS family), physical protection (PE family), security planning (PL family), and risk assessment processes (RA family) cannot be verified through API-based configuration checks.
Can I inherit controls from my IaaS provider's FedRAMP authorization?
Yes, and you should. AWS, Azure, and GCP each hold FedRAMP High authorizations. Controls fully implemented by the IaaS provider (e.g., PE-family physical security controls) are inherited and documented in your SSP's Customer Responsibility Matrix (CRM). Partially inherited controls require you to implement your portion, and your 3PAO will validate that inherited control claims match the IaaS provider's CRM. A SaaS built on FedRAMP-authorized IaaS can typically inherit 30 to 50 percent of Moderate controls.