When you here the words low, moderate, and high in terms of FedRamp these classifications get derived from FIPS 199 Standards for Security Categorization of Federal Information and Information Systems also created under the FISMA umbrella