FedRAMP class finder
Free tool: answer three FIPS 199 impact questions and see your security categorization, the paired FedRAMP 20x class (B or C), and which Key Security Indicators apply. Client-side, no signup.
The categorization uses the FIPS 199 high-water mark (the highest of the three objectives). During the 2026 FedRAMP 20x transition, Low pairs with Class B, Moderate with Class C. A High result maps to Class D, which is proposal-stage, so it is flagged provisional with no KSI list. scm.cc is not a 3PAO and this is not an authorization or a finding.
Confidentiality
What is the impact if the information handled by the system were disclosed to unauthorized parties?
Integrity
What is the impact if that information or the system were modified or destroyed without authorization?
Availability
What is the impact if access to the system or its information were disrupted?
Low impact → Class B
Baseline: FedRAMP Rev 5 Low. A Low categorization pairs with Class B (Rev 5 Low) during the 2026 transition.
41 Key Security Indicators apply (5 optional for this class):
- KSI-CED-RAT Cybersecurity Education
- KSI-CMT-LMC Change Management
- KSI-CMT-RMV Change Management
- KSI-CMT-RVP Change Management
- KSI-CMT-VTD Change Management
- KSI-CNA-DFP Cloud Native Architecture
- KSI-CNA-IBP Cloud Native Architecture
- KSI-CNA-MAT Cloud Native Architecture
- KSI-CNA-OFA Cloud Native Architecture
- KSI-CNA-RNT Cloud Native Architecture
- KSI-CNA-RVP Cloud Native Architecture
- KSI-CNA-ULN Cloud Native Architecture
- KSI-IAM-AAM Identity and Access Management
- KSI-IAM-APM Identity and Access Management
- KSI-IAM-ELP Identity and Access Management
- KSI-IAM-JIT Identity and Access Management
- KSI-IAM-SNU Identity and Access Management
- KSI-IAM-SUS Identity and Access Management
- KSI-INR-AAR Incident Response
- KSI-INR-RIR Incident Response
- KSI-INR-RPI Incident Response
- KSI-MLA-EVC Monitoring, Logging, and Auditing
- KSI-MLA-LET Monitoring, Logging, and Auditing
- KSI-MLA-OSM Monitoring, Logging, and Auditing
- KSI-MLA-RVL Monitoring, Logging, and Auditing
- KSI-PIY-GIV Policy and Inventory
- KSI-PIY-RES Policy and Inventory
- KSI-PIY-RIS Policy and Inventory
- KSI-PIY-RSD Policy and Inventory
- KSI-PIY-RVD Policy and Inventory
- KSI-RPL-ABO Recovery Planning
- KSI-RPL-ARP Recovery Planning
- KSI-RPL-RRO Recovery Planning
- KSI-RPL-TRC Recovery Planning
- KSI-SCR-MIT Supply Chain Risk
- KSI-SCR-MON Supply Chain Risk
- KSI-SVC-ACM Service Configuration
- KSI-SVC-ASM Service Configuration
- KSI-SVC-EIS Service Configuration
- KSI-SVC-SIN Service Configuration
- KSI-SVC-VRI Service Configuration
Optional for this class: KSI-CNA-EIS, KSI-MLA-ALA, KSI-SVC-PRR, KSI-SVC-RUD, KSI-SVC-VCM
Sources
- NIST FIPS 199 — Standards for Security Categorization (high-water mark) (retrieved 2026-10-31)
- FedRAMP 20x classes and Rev 5 baseline pairing (retrieved 2026-10-31)
- FedRAMP consolidated rules (KSI class applicability) (retrieved 2026-10-13)