I'm new to FedRAMP, but have had a number of years working with RMF. The org is trying to process Moderate level information on a Li-SaaS cloud system. Does anyone have any experienced with this? Did you just add additional controls to accommodate the higher impact or is this not allowed?