FedRAMP Low Baseline Rev 4
Best for: Cloud service providers (CSPs) seeking or maintaining a FedRAMP Low authorization to operate (ATO) for systems handling low-impact federal data under FIPS 199. This applies to any CSP, regardless of size, that sells cloud services to U.S. federal agencies where loss of confidentiality, integrity, or availability would have limited adverse effects. If your agency sponsor issued your ATO under NIST 800-53 Rev 4, this baseline applied to you. New authorizations require Rev 5.
| Mandatory? | Mandatory for CSPs selling to U.S. federal agencies |
| Who validates? | 3PAO (Third Party Assessment Organization) · No self-assessment |
| Renewal | Continuous monitoring; annual assessment |
| Scope | Cloud service offering for federal use (low impact) |
🏛 U.S. General Services Administration (GSA), FedRAMP Program Management Office (PMO) · FedRAMP Low Rev 4 Official source →
Get Started
module "..." {
source = "fedramplow.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Audit Logging and Monitoring: Runs 11 controls validating CloudTrail configuration across regions, S3 data event logging, CloudWatch integration, log file validation, alarm actions, and log retention periods. Covers the technical requirements for AU-2, AU-3, AU-6, AU-9, and AU-12.
- Encryption and Certificate Management: ACM certificate expiration windows and KMS CMK encryption on CloudTrail logs are both evaluated. Customer-managed keys satisfy SC-28; AWS-managed defaults do not, and the check distinguishes between them.
- Boundary Protection and Network Segmentation: Three SC-7 boundary checks: Auto Scaling launch configurations must not assign public IPs, DMS replication instances must not be publicly accessible, and API Gateway stages must have WAF web ACLs attached.
- Backup and Recovery: Validates that AWS Backup plan retention meets the 35-day minimum and that Auto Scaling groups behind load balancers use health checks to support automatic instance recovery.
- Secure Development and Build Configuration: Two CodeBuild checks: whether projects store sensitive AWS values in plaintext environment variables, and whether source repositories authenticate via OAuth rather than personal access tokens.
What you handle
- Audit Logging and Monitoring: Defining audit event types in your SSP, performing regular log reviews (the procedural requirement under AU-6), documenting your audit reduction and report generation process, and establishing and testing alerting thresholds for security-relevant events.
- Encryption and Certificate Management: Documenting key management procedures, implementing rotation schedules, managing key access policies, and confirming FIPS 140-2 validated cryptographic modules are used where SC-13 requires them.
- Boundary Protection and Network Segmentation: Documenting the full authorization boundary in your SSP, maintaining current network architecture diagrams, configuring WAF rule sets appropriate to your threat model, and managing security group rules outside the scope of these specific checks.
- Backup and Recovery: Writing and testing your Contingency Plan (CP), conducting annual contingency plan tests per CP-4, defining recovery time and recovery point objectives, and documenting backup restoration test results.
- Secure Development and Build Configuration: Establishing a full secure development lifecycle under SA-11, routing secrets through a dedicated secrets manager, and maintaining documented configuration baselines for all build and deployment pipelines.
Controls by Category
Audit and Accountability (AU) (6 controls)
3PAOs verify that audit logging covers the full authorization boundary with no gaps. They expect CloudTrail enabled across all regions (AU-2, AU-3, AU-12), log integrity validation confirming logs have not been tampered with (AU-9), and centralized aggregation through CloudWatch (AU-6). Trails scoped to a single region and log groups with retention periods too short to support incident investigation timelines are the most common findings in this category.
compliance.tf moduleCloudWatch log groups should have retention period of at least 365 dayscompliance.tf moduleContingency Planning (CP) (1 control)
CP-9 backup retention is what assessors ask for first: the 35-day minimum aligns with FedRAMP continuous monitoring requirements for data recovery. Health check configuration on Auto Scaling groups covers the CP-10 automatic recovery requirement by ensuring unhealthy instances are replaced without manual intervention. Come prepared with evidence of tested recovery procedures, not just configured backup policies.
System and Communications Protection (SC) (2 controls)
Assessors check encryption in transit and at rest (SC-8, SC-28) and boundary protection controls (SC-7), treating expired or near-expiry ACM certificates as direct findings rather than observations. Public IP assignment on Auto Scaling launch configurations and DMS replication instances violates SC-7, as does an API Gateway stage without a WAF web ACL attached.
Additional Controls (65)
AWS IAM (3)
AWS Lambda (4)
Amazon CloudWatch Logs (1)
Amazon EC2 (5)
compliance.tf moduleEC2 instances should have EBS optimization enabledcompliance.tf moduleEC2 instances should be in a VPCcompliance.tf moduleEC2 instances should not have a public IP addresscompliance.tf moduleEC2 instances should use IMDSv2compliance.tf moduleAmazon ElastiCache (1)
Amazon OpenSearch Service (2)
Amazon RDS (13)
compliance.tf moduleRDS DB instances and clusters should have enhanced monitoring enabledcompliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances backup retention period should be greater than or equal to 7compliance.tf moduleRDS DB instances should be integrated with CloudWatch logscompliance.tf moduleRDS DB instances should have deletion protection enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS for MariaDB DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should have multiple AZ enabledcompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS for PostgreSQL DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleRDS for SQL Server DB instances should publish logs to CloudWatch Logscompliance.tf moduleAmazon Redshift (7)
compliance.tf moduleRedshift clusters should have automatic snapshots enabledcompliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have KMS encryption enabledcompliance.tf moduleRedshift clusters should have required maintenance settingscompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (12)
compliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have default encryption enabled using KMScompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleS3 public access should be blocked at bucket levelcompliance.tf moduleAmazon SageMaker (4)
Elastic Load Balancing (6)
compliance.tf moduleELB application load balancer deletion protection should be enabledcompliance.tf moduleELB application load balancers should be configured to drop HTTP headerscompliance.tf moduleELB application load balancers should drop invalid HTTP headerscompliance.tf moduleELB application and network load balancer listeners should use secure protocolscompliance.tf moduleELB classic load balancers should have cross-zone load balancing enabledcompliance.tf moduleRelated Frameworks
NIST 800-53 Rev 4 — 🟢 High overlap (85%)
FedRAMP Low Rev 4 is a direct subset of NIST 800-53 Rev 4, selecting 125 controls from the full catalog and adding FedRAMP-specific parameter values. If you have already mapped to the full 800-53 Rev 4 catalog, the FedRAMP Low controls are covered, though FedRAMP imposes stricter parameter settings on several of them.
FedRAMP Moderate Rev 4 — 🟢 High overlap (70%)
FedRAMP Moderate Rev 4 is a superset of the Low baseline, adding approximately 200 controls. Every Low control appears in Moderate, so Low compliance is a useful foundation if you later need Moderate authorization.
NIST 800-53 Rev 5 — 🟢 High overlap (65%)
NIST 800-53 Rev 5 reorganized and expanded the control catalog relative to Rev 4. Many Rev 4 controls map directly to Rev 5 equivalents, but Rev 5 introduced new control families (PT, SR) and consolidated others. The FedRAMP Rev 5 baselines draw from this updated catalog.