Description of Documentation Need
docs/path-to-authorization.md presents the authorization-package templates as covering three baselines. At main @ 6d7d08c0:
- Line 3, the document subtitle:
Impact Level 5 (H-H-X), FedRAMP High & FedRAMP Moderate
- Lines 70-71: a link labeled
FedRAMP High & Moderate Authorization Boundary
- Lines 113-114:
Security Control Traceability Matrix (SCTM) Templates — (IL5 H-H-X, FedRAMP High, and FedRAMP Moderate Baselines)
- Lines 116-117:
Policies and Procedures Templates — (IL5 HHX, FedRAMP High, and FedRAMP Moderate Baselines)
No Moderate baseline appears to exist for any of the authorization-package artifacts.
The two families that live in this repository can be checked directly — git ls-tree -r main -- docs/artifacts/ at 6d7d08c0 returns four template files and no others:
docs/artifacts/hw-sw-list/FedRAMP_High_HWSWList_Template.xlsx
docs/artifacts/hw-sw-list/IL5_HWSWList_Template.xlsx
docs/artifacts/ppsms/FedRAMP_High_PPSMBoundariesInformationExport_Template.xlsx
docs/artifacts/ppsms/IL5_PPSMBoundariesInformationExport_Template.xlsx
Two regimes, no Moderate.
The remaining families are not in the repository at all — there is no System Security Plan template, no SCTM template and no Policies and Procedures template anywhere in the tree. Those are hosted on Drive, in the ATO Artifacts folder this document's template links resolve to:
https://drive.google.com/drive/folders/1NeWZcOuxysi7kUNRCFDd8CeHnxF14ywp
Every family in it is the same two regimes:
| Family |
What is there |
Moderate? |
| Policies and Procedures |
subfolders FedRAMP High (20 documents) and IL5, plus the Policies and Procedures User Guide |
no |
| SSP |
FedRAMP_High_SSP_System Security Plan_Template, IL5_SSP_System Security Plan_Template |
no |
| SCTM |
SCTM_Burndown_Tool_rev5_FedRAMP_High, SCTM_Burndown_Tool_rev5_IL5_HHX |
no |
| PPSM |
the same FedRAMP_High / IL5 pair also committed to docs/artifacts/ppsms/ |
no |
The Policies and Procedures set is the one line 116 sends a reader to, and it is the largest of the families — twenty documents per regime, one per 800-53 control family, named <Regime>_<Family Code>_<Family Name>_Rev<#>_Template (for example FedRAMP_High_AC_Access Control_Rev5_Template and IL5_HHX_AC_Access Control_Rev5_Template). There is no FedRAMP Moderate subfolder beside them.
So across both hosting locations, and across all five artifact families, the only values of <Regime> in use are FedRAMP_High and IL5 / IL5_HHX.
So a reader who follows this document to assemble a FedRAMP Moderate authorization package is told the Moderate baselines exist and then cannot find them.
This became more visible with v3.0.0. Platform-level FedRAMP Moderate support landed in PR #162 (closing #101): kms_protection_level became a variable across 0-bootstrap, 1-resman, 2-networking and 3-security, and the networking stage is now "FedRAMP High / Moderate". An operator can therefore stand up a Moderate landing zone today, and then finds neither a Moderate workload blueprint (#192) nor a Moderate authorization package.
Target Audience
Anyone assembling an authorization package for a FedRAMP Moderate system: SSP authors, ISSOs and ISSMs, the partners this template set exists to accelerate, and the Authorizing Official who receives the package. Also anyone doing regime selection early in a program, where "is the paperwork ready for Moderate?" is a real input to choosing Moderate over High.
Proposed Location
docs/path-to-authorization.md — the four places listed above. Whatever indexes the template set itself should carry the same statement, so the document and the deliverable cannot drift apart again.
Content Outline / Draft
Correct the four references to name the baselines that are actually available — IL5 (H-H-X) and FedRAMP High — and add one sentence on whether Moderate is planned. A statement of intent is genuinely useful on its own: a team choosing between High and Moderate can plan around "Moderate templates are not available yet," but cannot plan around a promise that does not resolve.
Stating the regimes each artifact family covers at the point of the link is what stops this recurring. Today the coverage claim appears only in the subtitle and in two parenthetical notes, and the System Security Plan link at line 85 carries no regime note at all, so its coverage has to be inferred from the subtitle.
Compliance Context (if applicable)
No control is mis-implemented — this is a documentation-coverage question rather than a control gap. It matters because these are the artifacts an assessor asks for by name: the System Security Plan (PL-2), the traceability matrix that carries control assessment and continuous monitoring (CA-2, CA-7), and the per-family policy and procedure documents required by the -1 control of every 800-53 family (AC-1, AU-1, and so on for all twenty). A Moderate baseline is not a subset of High that a team can safely tailor down by hand: the control selections differ, and starting from the High templates and deleting controls is exactly the kind of undocumented tailoring that costs time in assessment. FedRAMP Moderate is also the larger share of federal and state workloads, so the audience for these artifacts is bigger than the audience for the High ones.
Description of Documentation Need
docs/path-to-authorization.mdpresents the authorization-package templates as covering three baselines. Atmain@6d7d08c0:Impact Level 5 (H-H-X), FedRAMP High & FedRAMP ModerateFedRAMP High & Moderate Authorization BoundarySecurity Control Traceability Matrix (SCTM) Templates—(IL5 H-H-X, FedRAMP High, and FedRAMP Moderate Baselines)Policies and Procedures Templates—(IL5 HHX, FedRAMP High, and FedRAMP Moderate Baselines)No Moderate baseline appears to exist for any of the authorization-package artifacts.
The two families that live in this repository can be checked directly —
git ls-tree -r main -- docs/artifacts/at6d7d08c0returns four template files and no others:Two regimes, no Moderate.
The remaining families are not in the repository at all — there is no System Security Plan template, no SCTM template and no Policies and Procedures template anywhere in the tree. Those are hosted on Drive, in the ATO Artifacts folder this document's template links resolve to:
Every family in it is the same two regimes:
FedRAMP High(20 documents) andIL5, plus the Policies and Procedures User GuideFedRAMP_High_SSP_System Security Plan_Template,IL5_SSP_System Security Plan_TemplateSCTM_Burndown_Tool_rev5_FedRAMP_High,SCTM_Burndown_Tool_rev5_IL5_HHXFedRAMP_High/IL5pair also committed todocs/artifacts/ppsms/The Policies and Procedures set is the one line 116 sends a reader to, and it is the largest of the families — twenty documents per regime, one per 800-53 control family, named
<Regime>_<Family Code>_<Family Name>_Rev<#>_Template(for exampleFedRAMP_High_AC_Access Control_Rev5_TemplateandIL5_HHX_AC_Access Control_Rev5_Template). There is noFedRAMP Moderatesubfolder beside them.So across both hosting locations, and across all five artifact families, the only values of
<Regime>in use areFedRAMP_HighandIL5/IL5_HHX.So a reader who follows this document to assemble a FedRAMP Moderate authorization package is told the Moderate baselines exist and then cannot find them.
This became more visible with
v3.0.0. Platform-level FedRAMP Moderate support landed in PR #162 (closing #101):kms_protection_levelbecame a variable across0-bootstrap,1-resman,2-networkingand3-security, and the networking stage is now "FedRAMP High / Moderate". An operator can therefore stand up a Moderate landing zone today, and then finds neither a Moderate workload blueprint (#192) nor a Moderate authorization package.Target Audience
Anyone assembling an authorization package for a FedRAMP Moderate system: SSP authors, ISSOs and ISSMs, the partners this template set exists to accelerate, and the Authorizing Official who receives the package. Also anyone doing regime selection early in a program, where "is the paperwork ready for Moderate?" is a real input to choosing Moderate over High.
Proposed Location
docs/path-to-authorization.md— the four places listed above. Whatever indexes the template set itself should carry the same statement, so the document and the deliverable cannot drift apart again.Content Outline / Draft
Correct the four references to name the baselines that are actually available — IL5 (H-H-X) and FedRAMP High — and add one sentence on whether Moderate is planned. A statement of intent is genuinely useful on its own: a team choosing between High and Moderate can plan around "Moderate templates are not available yet," but cannot plan around a promise that does not resolve.
Stating the regimes each artifact family covers at the point of the link is what stops this recurring. Today the coverage claim appears only in the subtitle and in two parenthetical notes, and the System Security Plan link at line 85 carries no regime note at all, so its coverage has to be inferred from the subtitle.
Compliance Context (if applicable)
No control is mis-implemented — this is a documentation-coverage question rather than a control gap. It matters because these are the artifacts an assessor asks for by name: the System Security Plan (PL-2), the traceability matrix that carries control assessment and continuous monitoring (CA-2, CA-7), and the per-family policy and procedure documents required by the
-1control of every 800-53 family (AC-1, AU-1, and so on for all twenty). A Moderate baseline is not a subset of High that a team can safely tailor down by hand: the control selections differ, and starting from the High templates and deleting controls is exactly the kind of undocumented tailoring that costs time in assessment. FedRAMP Moderate is also the larger share of federal and state workloads, so the audience for these artifacts is bigger than the audience for the High ones.