[Documentation] path-to-authorization.md advertises FedRAMP Moderate baselines for the SCTM and Policies and Procedures templates, but the published template set is FedRAMP High and IL5 only

Open docs/path-to-authorization.md and review the subtitle and the references around lines 70-71, 85, and 113-117. Update the coverage statements to match the available IL5 and FedRAMP High templates, state whether Moderate templates are planned, and check any index for the template set so its coverage description stays consistent.

Description of Documentation Need

docs/path-to-authorization.md presents the authorization-package templates as covering three baselines. At main @ 6d7d08c0:

• Line 3, the document subtitle: Impact Level 5 (H-H-X), FedRAMP High & FedRAMP Moderate
• Lines 70-71: a link labeled FedRAMP High & Moderate Authorization Boundary
• Lines 113-114: Security Control Traceability Matrix (SCTM) Templates — (IL5 H-H-X, FedRAMP High, and FedRAMP Moderate Baselines)
• Lines 116-117: Policies and Procedures Templates — (IL5 HHX, FedRAMP High, and FedRAMP Moderate Baselines)

No Moderate baseline appears to exist for any of the authorization-package artifacts.

The two families that live in this repository can be checked directly — git ls-tree -r main -- docs/artifacts/ at 6d7d08c0 returns four template files and no others:

docs/artifacts/hw-sw-list/FedRAMP_High_HWSWList_Template.xlsx
docs/artifacts/hw-sw-list/IL5_HWSWList_Template.xlsx
docs/artifacts/ppsms/FedRAMP_High_PPSMBoundariesInformationExport_Template.xlsx
docs/artifacts/ppsms/IL5_PPSMBoundariesInformationExport_Template.xlsx

Two regimes, no Moderate.

The remaining families are not in the repository at all — there is no System Security Plan template, no SCTM template and no Policies and Procedures template anywhere in the tree. Those are hosted on Drive, in the ATO Artifacts folder this document's template links resolve to:

https://drive.google.com/drive/folders/1NeWZcOuxysi7kUNRCFDd8CeHnxF14ywp

Every family in it is the same two regimes:

The Policies and Procedures set is the one line 116 sends a reader to, and it is the largest of the families — twenty documents per regime, one per 800-53 control family, named <Regime>_<Family Code>_<Family Name>_Rev<#>_Template (for example FedRAMP_High_AC_Access Control_Rev5_Template and IL5_HHX_AC_Access Control_Rev5_Template). There is no FedRAMP Moderate subfolder beside them.

So across both hosting locations, and across all five artifact families, the only values of <Regime> in use are FedRAMP_High and IL5 / IL5_HHX.

So a reader who follows this document to assemble a FedRAMP Moderate authorization package is told the Moderate baselines exist and then cannot find them.

This became more visible with v3.0.0. Platform-level FedRAMP Moderate support landed in PR #162 (closing #101): kms_protection_level became a variable across 0-bootstrap, 1-resman, 2-networking and 3-security, and the networking stage is now "FedRAMP High / Moderate". An operator can therefore stand up a Moderate landing zone today, and then finds neither a Moderate workload blueprint (#192) nor a Moderate authorization package.

Target Audience

Anyone assembling an authorization package for a FedRAMP Moderate system: SSP authors, ISSOs and ISSMs, the partners this template set exists to accelerate, and the Authorizing Official who receives the package. Also anyone doing regime selection early in a program, where "is the paperwork ready for Moderate?" is a real input to choosing Moderate over High.

Proposed Location

docs/path-to-authorization.md — the four places listed above. Whatever indexes the template set itself should carry the same statement, so the document and the deliverable cannot drift apart again.

Content Outline / Draft

Correct the four references to name the baselines that are actually available — IL5 (H-H-X) and FedRAMP High — and add one sentence on whether Moderate is planned. A statement of intent is genuinely useful on its own: a team choosing between High and Moderate can plan around "Moderate templates are not available yet," but cannot plan around a promise that does not resolve.

Stating the regimes each artifact family covers at the point of the link is what stops this recurring. Today the coverage claim appears only in the subtitle and in two parenthetical notes, and the System Security Plan link at line 85 carries no regime note at all, so its coverage has to be inferred from the subtitle.

Compliance Context (if applicable)

No control is mis-implemented — this is a documentation-coverage question rather than a control gap. It matters because these are the artifacts an assessor asks for by name: the System Security Plan (PL-2), the traceability matrix that carries control assessment and continuous monitoring (CA-2, CA-7), and the per-family policy and procedure documents required by the -1 control of every 800-53 family (AC-1, AU-1, and so on for all twenty). A Moderate baseline is not a subset of High that a team can safely tailor down by hand: the control selections differ, and starting from the High templates and deleting controls is exactly the kind of undocumented tailoring that costs time in assessment. FedRAMP Moderate is also the larger share of federal and state workloads, so the audience for these artifacts is bigger than the audience for the High ones.