A moderate impact level occurs when the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
A serious adverse effect means that, for example, the loss of confidentiality, integrity, or availability might:
Cause a significant deterioration of mission capability, but CMS is still able to perform its primary functions
Effectiveness of functions is noticeably reduced
Result in significant damage to organizational assets
Result in significant financial loss
Result in significant harm to individuals that does not involve loss of life or serious life threatening injuries
It adds that ChatGPT has been granted an "Authority to Operate" at the FISMA Moderate level, referring to the Federal Information Security Modernization Act.
Here's what "moderate" means: