What Is FedRAMP LI-SaaS? Legacy Baseline Explained

The Federal Risk and Authorization Management Program (FedRAMP) created the Tailored baseline for Low-Impact SaaS (LI-SaaS) in 2017. It allowed collaboration and project-management tools that hold nothing beyond a username, password, and email address to get authorized without meeting the full Low FedRAMP baseline requirements.

For a vendor with a deal waiting on authorization, the current decision is which Certification Class to pursue under the 2026 rules; LI-SaaS survives only as legacy documentation for pre-2026 authorization packages.

Key Takeaways

• LI-SaaS is legacy. Finalized in 2017 for SaaS tools storing no personally identifiable information (PII) beyond login credentials; the documentation moved to FedRAMP's legacy documentation site on June 24, 2026.  
• Eligibility follows data. Each information type should be assessed independently for confidentiality, integrity, and availability, and the system's overall Federal Information Processing Standard 199 (FIPS 199) categorization uses the highest resulting rating for each objective; the LI-SaaS PII eligibility limits disqualify products holding PII beyond a login profile.  
• Testing scope shrinks. Independent FedRAMP control testing requires an independent assessor to test the offering against the applicable control baseline, and continuous monitoring continues after authorization.  
• 20x Class B. The FedRAMP Consolidated Rules for 2026 (CR26) were released June 24, 2026 and become mandatory January 1, 2027; the current ruleset is v2026.07.14.01 (July 14, 2026). The rules replaced impact-level baselines with Certification Classes A through D; Class B requires at least 155 National Institute of Standards and Technology (NIST) SP 800-53 Rev5 (September 2020) controls; FedRAMP stops accepting new Rev5 applications on June 11, 2027.

LI-SaaS Is FedRAMP's Reduced-Scope Baseline for Low-Risk SaaS Tools

FedRAMP Tailored for LI-SaaS is one of the two legacy baselines for systems with Low-impact data within the FedRAMP program. The FedRAMP Tailored finalization process concluded in September 2017 after the FedRAMP Program Management Office (PMO) worked with the Office of Management and Budget (OMB), NIST, and the Joint Authorization Board (JAB). The PMO described the outcome as "two baselines for systems with Low-impact data: LI-SaaS baseline and Low baseline."

The baseline covered SaaS applications that stored no PII beyond a username, password, and email address, with consolidated documentation and fewer controls requiring testing and verification than a standard Low authorization. SaaS here is the service model defined in NIST SP 800-145. The PMO built it because the existing baselines were one-size-fits-all and a tailored approach was needed to support low-risk industry tools.

A SaaS Tool Qualified Only With Low-Impact Data and Login-Only PII

The current FedRAMP Consolidated Rules for 2026 retired LI-SaaS and set Rev5 baselines per Certification Class: Class B at least 155, Class C at least 322, and Class D at least 409 NIST SP 800-53 Rev5 controls.

Historically, a service's FIPS 199 categorization was determined by the high-water mark across the confidentiality, integrity, and availability impacts of the information types it handled; any Moderate or High impact moved it out of Low. It used the FIPS 199 security standard, where a loss on any objective would have a "limited adverse effect" on operations, assets, or individuals. FedRAMP applied the high-water mark, so a single Moderate rating on one objective pushed the whole system out of LI-SaaS.

FedRAMP's historical LI-SaaS eligibility questionnaire asked a cloud service provider (CSP) to answer yes to all of the following:

• The service runs in a cloud environment and is fully operational.  
• The service is SaaS as defined by NIST SP 800-145.  
• The service contains no PII except what login requires: username, password, and email address.  
• The service is low-security-impact as defined by FIPS 199.  
• The service is hosted on a FedRAMP-authorized Platform as a Service (PaaS) or Infrastructure as a Service (IaaS), or the CSP operates the underlying infrastructure to the applicable controls itself.

Collaboration suites, project-management applications, survey tools, scheduling software, learning management systems, and developer tooling could qualify. Anything holding PII beyond a login profile failed.

LI-SaaS Authorization Followed Seven Steps From Scoping Through Continuous Monitoring

For pre-2026 authorization packages, LI-SaaS was available only through the Agency Authorization path. A package couldn't obtain a JAB provisional ATO, so an agency Authorizing Official (AO) signed the final decision. New providers cannot begin an LI-SaaS application under the current FedRAMP rules.

1. Confirmed Eligibility Through FIPS 199 Categorization

Providers used the FedRAMP FIPS 199 Categorization Template and NIST SP 800-60 Volume 2 Rev1 to categorize each information type the service handled. Under FIPS 199, the system's overall security category was determined by the highest confidentiality, integrity, or availability rating; if the category was above Low, the service did not qualify.

2. Defined and Documented the Authorization Boundary

FedRAMP's Authorization Boundary Guidance required a diagram of internal services, components, and devices plus every external connection. A SaaS product running on an authorized IaaS or PaaS could inherit controls from that underlying provider.

3. Mapped Required Controls to NIST SP 800-53 Rev5

SSP Appendix A, "LI-SaaS FedRAMP Security Controls," listed the baseline control requirements against NIST SP 800-53 Rev5. Which conditional controls applied depended on whether the triggering condition existed inside the boundary.

4. Built the SSP and Supporting Documentation

Providers assembled the System Security Plan (SSP) on the FedRAMP baseline template. Appendix E held the CSP's attestations for controls that were not independently tested.

5. Implemented and Evidenced the FedRAMP Baseline Controls

Providers configured the independently tested controls to produce the evidence an assessor would inspect, and they remediated gaps before the assessment window opened.

6. Completed the Limited-Scope Independent Assessment

The CSP completed agency sponsorship and independent assessment service (formerly Third-Party Assessment Organization, 3PAO) engagement. The independent assessment service followed the documented authorization roles and responsibilities by writing a Security Assessment Plan (SAP) from the approved SSP, testing the in-scope controls, and issuing a Security Assessment Report (SAR).

7. Submitted the Package and Enter Continuous Monitoring

The AO reviewed the SSP, SAP, SAR, and POA&M and issued an ATO or Authority to Use covering that agency's use only. Under subsequent agency authorization requirements, each later agency customer issued its own ATO with its own ConMon review.

LI-SaaS Reduced What Was Independently Tested, Not What Applied

The legacy LI-SaaS and Low baselines had roughly the same control total, but LI-SaaS required independent verification of fewer controls. The independent assessment service tested the applicable, in-scope controls, with inherited controls limiting what the CSP had to demonstrate directly.

The Rev5 baseline materials put most of the remainder in SSP Appendix E, where the CSP attested to them, with a smaller conditional set assessed only when a triggering condition existed, such as external connections or privileged users.

An assessor examined the following control families for any hosted application:

• Access control  
• Identification and authentication  
• Audit and accountability  
• Configuration management  
• Incident response  
• Contingency planning  
• System and information integrity  
• Supply chain risk management

The SSP remained mandatory but ran on a reduced appendix set, and every CSP attestation had to be accurate. After the Authority to Operate (ATO) was issued, FedRAMP Post-ATO requirements continued under FedRAMP's continuous monitoring (ConMon) process: monthly vulnerability scans, Plan of Action and Milestones (POA&M) and inventory updates, an annual independent assessment, and incident reports as they occurred. Those ongoing obligations shaped LI-SaaS's practical time and cost differences from the other legacy baselines.

LI-SaaS Was Narrower and Faster Than the Low, Moderate, and High Baselines

The four legacy Rev5 baselines compare as follows, with the control counts as published in the pre-2026 Rev5 materials.

Those control counts describe pre-2026 authorization packages only. Under the FedRAMP Consolidated Rules for 2026, mandatory January 1, 2027, baselines were renamed as Certification Classes and LI-SaaS materials moved to the legacy documentation site during the CR26 transition. The CR26 Practices expire no later than December 31, 2028, a ruleset expiry across both Rev5 and 20x rather than a sunset of existing Rev5 certifications themselves. Any provider holding a legacy LI-SaaS or Low authorization must move to a current Certification Class (typically Class B) before that date to remain on the Marketplace.

FIPS 199 categorization stays a separate exercise that sets the security category; the provider then elects the Class it will pursue.

FedRAMP 20x Class B Replaces LI-SaaS, and Pre-Authorized Boundaries Shorten the Path

FedRAMP, a General Services Administration (GSA) program, opened the 20x Phase One pilot for Low-impact, cloud-native SaaS in May 2025, and the first 20x Low authorizations followed within months. Rather than assessing controls one by one, 20x measures Key Security Indicators, and the PMO issues sponsor-free 12-month authorizations directly.

The pilots are over. Under the Consolidated Rules for 2026, the 20x Class B and Class C pipelines opened on August 31, 2026; new Rev5 applications close on June 11, 2027, and the CR26 Practices expire no later than December 31, 2028. LI-SaaS is now legacy material for pre-2026 authorizations rather than a current baseline, and the Marketplace no longer lists it as a separate category.

Class B still requires at least 155 NIST SP 800-53 Rev5 controls, and LI-SaaS re-authorization requirements (RFC 0009) confirm that an impact categorization change "will lead to a re-authorization of the service at the new impact level." To absorb that scope without rebuilding from scratch, most vendors now stand their SaaS on a pre-authorized FedRAMP boundary and inherit most controls from the platform beneath them.

A Pre-Authorized Boundary Turns Class B From a Multi-Year Project Into a 90-Day One

Eligibility for LI-SaaS depended exclusively on data, never company size, and that distinction still matters: a collaboration tool categorized as Low stops being Low the moment an agency stores CUI in it, which generally drives at least a Moderate FIPS 199 confidentiality impact and forces re-authorization at a higher Certification Class.

Knox Systems is a FedRAMP-as-a-Service platform built on a pre-authorized FedRAMP boundary. SaaS vendors inherit 60% to 80% of required NIST SP 800-53 Rev5 controls, and achieve authorization in approximately 90 days at roughly 90% less than the traditional cost. Knox currently supports FedRAMP Moderate, FedRAMP High, and DISA IL-4. IL-5 authorization is in process, with an estimated completion date of December 2026.

Book a meeting to scope which Certification Class your product needs before new Rev5 applications close on June 11, 2027.

FAQs about FedRAMP LI-SaaS

Is FedRAMP Required for Every SaaS Tool a Federal Agency Uses?

OMB Memorandum M-24-15 (July 25, 2024) requires a FedRAMP authorization for any cloud service that creates, collects, processes, stores, or maintains federal information on behalf of an agency. The agency determines whether a specific use falls in scope. M-24-15 also bars agencies from demanding a specific certification type or path unless the agency head or an authorized delegate documents a demonstrable need and notifies FedRAMP.

Are Class B and LI-SaaS Control Counts Identical?

No. Class B requires at least 155 controls, while the legacy LI-SaaS baseline had 156. They are distinct frameworks despite their similar control counts.

How Many Products Hold LI-SaaS Authorization on the FedRAMP Marketplace?

The official FedRAMP Marketplace listed 66 products under Class B on September 4, 2026. The count included authorized, ready, and in-process systems. To get a current LI-SaaS-only figure, you must check individual product pages.

‍