I'm trying to figure out if the appropriate 800-53 low/mod/high baselines need to be documented when submitting an authorization for a cloud service. The contractors mostly just do the controls listed in 800-171. My gut says that the applicable 800-53 baselines should be submitted. This would also be for an ATO and not an ATU.