Scenario Library — FedRAMP Systems, Low to High

Nine illustrative FedRAMP systems — SaaS, PaaS, IaaS, and LI-SaaS from Low to High baselines. Practice inheritance and control decisions. Educational.

Nimbus CRM

SaaS · CRM on a FedRAMP Certified PaaS

SaaS CRM on a FedRAMP Certified PaaS. Customer uses enterprise IdP (SAML/OIDC). PaaS/CSP and OS layers are static inheritance, not the learner’s to write.

SP 800-60: B10.813.108 Customer Services · B10.813.518 Customer Feedback — FIPS 199 Moderate

Aurora Teamspace

SaaS · enterprise collaboration

Enterprise collaboration SaaS: channels, DMs, files, and guests, on a FedRAMP Certified PaaS. SCIM/IdP and tenant app policies are the learner’s customer layer.

SP 800-60: B10.811.340 Collaboration Tools · B10.812.577 Knowledge Distribution and Delivery — FIPS 199 Moderate

Verde HR & Talent

SaaS · human-capital management

HR / talent SaaS (core HR, comp, performance, time) on a FedRAMP Certified PaaS. HCM/IdP and application entitlements to sensitive workforce data are the learner’s customer story.

SP 800-60: B10.805.254 Employee Benefits and Compensation · B10.805.624 Payroll — FIPS 199 Moderate

Helios Service Hub

SaaS · IT service management

ITSM / service desk: incidents, changes, requests, CMDB, agent consoles. PaaS operator identity is inherited.

SP 800-60: B10.813.120 Help Desk Services · B10.813.263 System and Network Monitoring — FIPS 199 Moderate

Quartz File Cloud

SaaS · enterprise file sync & share

Enterprise file sync & share, shared libraries, and guest links (not the same as channel chat). PaaS/storage substrate inherited.

SP 800-60: B10.813.661 Document Management and Workflow · B10.804.345 Management of Government Records — FIPS 199 Moderate

Granite GovCloud

IaaS · provider side, FedRAMP High

Play the provider side for once: you are the cloud service provider's security team authoring the IaaS platform's own High-baseline SSP — the package every tenant inherits from.

SP 800-60: B10.813.139 Provide and Maintain IT Infrastructure · B10.810.316 Continuous Monitoring — FIPS 199 High

Meridian Pipeline

PaaS · agency platform team, Moderate

The mid-stack seat: an agency platform team running a container/CI-CD platform on inherited IaaS — inheriting from below, while authoring the controls its application teams inherit from above.

SP 800-60: B10.813.326 IT System Development / Integration Support · B10.813.139 Provide and Maintain IT Infrastructure — FIPS 199 Moderate

Beacon Forms

LI-SaaS · public feedback forms, Low

The right-sized package: a small public-feedback form service at the LI-SaaS (Low) baseline — where the craft is matching the narrative to what the program actually runs, without gold-plating or hand-waving.

SP 800-60: B10.808.113 Public Comment Tracking · B10.813.518 Customer Feedback — FIPS 199 Low

Sentinel Response

SaaS · agency tenant, FedRAMP High

The tenant side at High: your agency runs its emergency-operations and continuity mission on a FedRAMP High cloud, and you author the customer-responsibility slice — where availability and integrity are life-safety properties, not paperwork.

SP 800-60: C.3.5.1 Disaster Monitoring and Prediction · C.3.5.4 Emergency Response — FIPS 199 High

RMF Coach is an educational simulation and training product — not an authorization, and not affiliated with or endorsed by NIST or FedRAMP.