GovRAMP (StateRAMP): Cloud Security for State and Local Government

GovRAMP, the programme formerly known as StateRAMP, verifies the security of cloud products sold to US state and local governments. Many states, cities, counties and public universities buy SaaS but lack the resources to assess every vendor themselves. GovRAMP lets a provider be assessed once against a standard based on NIST SP 800-53 Rev. 5 and FedRAMP baselines, then share that status with every participating government.

The programme offers a stepwise path: a Security Snapshot to measure maturity, a Core status covering 60 priority controls, and full Ready, Provisionally Authorized or Authorized statuses based on independent assessments, with continuous monitoring. Providers with FedRAMP assessments can use a fast track. This guide explains the statuses, impact levels, process, costs, how GovRAMP compares with FedRAMP, and how SaaS companies can prepare.

What is GovRAMP?

In April 2020, a steering committee of government and industry leaders chartered StateRAMP to create a common way to verify the security of cloud services used by state and local government, modelled on the federal FedRAMP programme. It operates as a 501(c)(6) nonprofit governed mainly by state and local government officials, and now does business as GovRAMP. Its framework applies third-party assessment, continuous monitoring and annual reassessment, the core practices of a risk and authorization management programme (RAMP).

GovRAMP's model is "verify once, serve many": participating governments can rely on a provider's GovRAMP status instead of running separate assessments. Membership includes state and local governments, public higher education, and, since 2023, private K-12 and higher education institutions.

Who requires GovRAMP?

• Participating states that require or prefer GovRAMP status in cloud procurements.
• Local governments, such as cities and counties, that adopt the requirement.
• Public universities, colleges and school systems.
• Other public sector and critical infrastructure organisations that use GovRAMP statuses as evidence.

Requirements are set by each government in its procurement, so providers should check each solicitation for the status and impact level required, any deadlines for achieving it, and whether a progressing status is acceptable while the provider works toward full verification. Texas runs its own programme, TX-RAMP, administered by the Texas Department of Information Resources.

Is it mandatory or voluntary?

GovRAMP is not a law. It becomes mandatory when a participating government requires a GovRAMP status for a contract. Providers apply voluntarily to be listed.

Statuses and the path to authorization

Status	What it means
Security Snapshot	A security maturity assessment against priority controls, valid for 12 months, used to start the process and guide improvement.
Progressing Security Snapshot Program	Ongoing quarterly Snapshots and monthly advisory calls while the provider matures.
Core	Verified status confirming 60 foundational NIST controls selected using MITRE ATT&CK and aligned with the Moderate baseline, validated by the GovRAMP PMO, with ongoing evidence requirements.
Ready	Independent 3PAO assessment shows the product meets minimum mandatory requirements and is ready for full authorization.
Provisionally Authorized	Meets authorization requirements but relies on interconnected technologies not yet GovRAMP or FedRAMP authorized, which must have a current Snapshot.
Authorized	Full compliance with all required controls for the product's impact level, the highest status.

Verified statuses are listed on GovRAMP's Authorized Product List. Providers working toward statuses appear on a progressing list as Active, In Process or Pending.

Impact levels

• Low: aligned with FedRAMP Rev. 5 Low baseline.
• Moderate: aligned with FedRAMP Rev. 5 Moderate baseline, the most common level for state and local SaaS.
• High: aligned with FedRAMP Rev. 5 High baseline for the most sensitive data.

The impact level is set by the data the product handles, using a data classification approach. GovRAMP has no geographic hosting requirement at Low or Moderate, but state laws and contracts may add requirements, and High impact data may face restrictions on foreign nationals, contractors or access locations.

Choosing the right impact level

The impact level depends on the potential harm if the data or system is compromised. Public information and low-risk services may fit Low. Most state and local SaaS handles personally identifiable information about residents or employees, case data, payments or operational records, which usually means Moderate. Systems supporting public safety, health or other highly sensitive functions may need High. Government customers decide the required level for their use, often using their own data classification policies. Providers should design for the highest level their target customers are likely to need, because moving from Low to Moderate later means adding many controls and a new assessment.

Third-party assessment organisations

Ready and Authorized statuses rely on independent assessments by third-party assessment organisations (3PAOs). GovRAMP requires 3PAOs to be accredited by A2LA to ISO/IEC 17020 and recognised by FedRAMP, so assessments can be reciprocated. Providers select and pay their 3PAO.

Fast Track for FedRAMP products

Products with FedRAMP Ready, Agency ATO or P-ATO status can use GovRAMP's Fast Track without a new audit. The framework also notes pilots for recognising other assessments, such as HITRUST, so providers with existing certifications should ask the GovRAMP PMO which evidence can be reused. Providers that have completed a FedRAMP audit can submit the same audit and security package to the GovRAMP PMO, even before their FedRAMP review is finished. This makes GovRAMP attractive for providers already pursuing FedRAMP.

Continuous monitoring

Once a verified status is awarded, providers enter continuous monitoring: monthly and quarterly reporting to the GovRAMP PMO, annual 3PAO assessments for Ready and Authorized products, and remediation of plan of action and milestones (POA&M) items within 30 days for high, 90 days for moderate and 180 days for low findings. Significant changes must be reported. Failing to meet monitoring obligations can lead to a status being suspended.

The process, step by step

1. Determine the impact level from the data your product will handle for government customers.
2. Request a Security Snapshot to measure maturity and identify gaps.
3. Remediate gaps and consider Core status as an early verified step.
4. Prepare documentation: system security plan, policies, inventories and diagrams aligned with NIST SP 800-53 Rev. 5.
5. Engage a 3PAO for a Ready or full assessment, or use Fast Track with a FedRAMP package.
6. Submit the package to the GovRAMP PMO for review.
7. Obtain government sponsorship or approval where needed for Authorized status.
8. Maintain continuous monitoring and annual assessments.

Writing the system security plan

The system security plan (SSP) is the central document for Ready and Authorized assessments. It describes the system boundary, components, data flows, users and interconnections, and explains how each required NIST SP 800-53 control is implemented, by whom, and whether responsibility is shared with the cloud infrastructure provider or the customer. Good SSPs are specific: they name tools, configurations and procedures rather than repeating control text. Keeping architecture diagrams, inventories and control descriptions in version control alongside the code makes the SSP easier to keep accurate as the product changes, which matters for continuous monitoring and annual assessments.

Working with offshore engineering teams

Many US SaaS companies use engineering partners outside the US. GovRAMP has no general rule against this at Low and Moderate, but government contracts may restrict where data is stored, who can access it and from where, and High impact data may carry restrictions on foreign nationals and access locations. Practical controls include keeping production data in US regions, giving offshore engineers access only to non-production environments with masked data, using privileged access management and session recording for any production access, documenting personnel screening, and making these arrangements explicit in the SSP so assessors and customers can evaluate them.

How governments use GovRAMP

For state and local buyers, GovRAMP reduces the burden of vetting cloud vendors. Agencies can require a minimum status in solicitations, check the Authorized Product List, review security packages through GovRAMP, and rely on continuous monitoring rather than running annual vendor audits themselves. Some states phase requirements, accepting Core or Snapshot participation for lower-risk purchases and requiring Ready or Authorized for higher-risk systems.

Documentation you will need

• System security plan and boundary diagrams.
• Policies and procedures for NIST SP 800-53 control families.
• Hardware and software inventories.
• Vulnerability scan results and penetration test reports.
• Security assessment report from a 3PAO.
• Plan of action and milestones.
• Incident response and contingency plans.
• Continuous monitoring reports.

Cost and timeline

GovRAMP charges fees for Snapshots and other services on a published schedule scaled by provider size and revenue. The larger costs are 3PAO assessments, remediation and continuous monitoring effort. A Snapshot and Core status can be achieved in weeks to a few months. Ready or Authorized status typically takes several months to a year, depending on maturity. Providers with existing FedRAMP packages move much faster through Fast Track.

GovRAMP compared with FedRAMP

Aspect	GovRAMP	FedRAMP
Customers	State and local government, education	US federal agencies
Operator	Nonprofit governed by state and local officials	US General Services Administration
Control basis	NIST SP 800-53 Rev. 5, FedRAMP Rev. 5 baselines	NIST SP 800-53 Rev. 5 and FedRAMP 20x approaches
Entry steps	Snapshot and Core status	Ready and authorization paths
Reciprocity	Fast Track accepts FedRAMP packages	Does not automatically accept GovRAMP

Benefits and limitations

• Benefits: one verification reusable across many governments, a stepwise path that suits growing companies, alignment with FedRAMP that eases later federal work, and continuous monitoring that builds trust with buyers.
• Limitations: not every state participates or requires it, Texas runs its own programme, full authorization is resource-intensive, and continuous monitoring adds ongoing cost and effort.

Penetration testing and vulnerability management

Assessments include vulnerability scanning of operating systems, databases and web applications, and penetration testing for higher statuses, following FedRAMP-style methods. In continuous monitoring, providers submit regular scan results and track every finding in the POA&M until it is fixed within the required timeframe. Building automated scanning into pipelines, patching on a fixed cadence, and keeping container images and dependencies current makes these obligations manageable. Late remediation is one of the most common reasons for problems during continuous monitoring, so ownership and deadlines for each finding should be clear.

Common mistakes

• Waiting for a tender to start, when assessments take months.
• Choosing the wrong impact level, such as Low when citizen data needs Moderate.
• Weak inventories and boundaries, which delay 3PAO assessments.
• Missing POA&M deadlines during continuous monitoring.
• Relying on uncovered subprocessors, leading only to Provisionally Authorized status.

Best practices, tools and technologies

• Build on a NIST SP 800-53 control framework from the start.
• Use authorized cloud infrastructure (FedRAMP or GovRAMP) as your hosting layer.
• Automate vulnerability scanning, patching and evidence collection.
• Keep accurate asset inventories and boundary diagrams in version control.
• Track POA&M items with clear owners and deadlines.

We build and operate SaaS platforms with NIST-aligned controls, logging, vulnerability management and documented architecture through our SaaS product and maintenance and support services.

How it relates to other frameworks

Framework	Relationship
FedRAMP	Federal counterpart; FedRAMP packages can be fast-tracked into GovRAMP.
NIST SP 800-53	The control catalogue GovRAMP is built on.
SOC 2	Commercial attestation; useful evidence but not a substitute.
CJIS Security Policy	FBI requirements for criminal justice data, which GovRAMP has explored harmonising with.
TX-RAMP	Texas state programme with its own certification levels.

Real-world example

A US-based permitting SaaS, built and maintained with an Indian engineering partner, wants to sell to several states and counties. It requests a GovRAMP Security Snapshot, fixes gaps in MFA coverage, logging retention and incident response, and earns Core status within three months, which satisfies some smaller buyers. It then engages a FedRAMP-recognised 3PAO for a Moderate Ready assessment, documents its system security plan, and enters continuous monitoring with monthly scans and POA&M tracking managed jointly with its engineering partner.

Next steps

1. Check which target governments require GovRAMP.
2. Determine your impact level.
3. Request a Security Snapshot.
4. Plan for Core, then Ready or Authorized.
5. Use Fast Track if you have a FedRAMP package.

Frequently asked questions

Is GovRAMP the same as StateRAMP?

Yes. GovRAMP is the current name of the programme founded as StateRAMP in 2020.

Who uses GovRAMP?

Participating state and local governments, public universities, school systems and other public bodies, which reference GovRAMP statuses in their cloud procurement requirements and check the Authorized Product List when evaluating vendors.

What is GovRAMP Core?

A verified status confirming 60 foundational NIST controls, offering an early step before full authorization.

What is a Security Snapshot?

A security maturity assessment of a cloud product, valid for 12 months, used to start the GovRAMP process.

Does GovRAMP accept FedRAMP?

Yes. Products with FedRAMP Ready, ATO or P-ATO status can use the Fast Track without a new audit.

What impact levels exist?

Low, Moderate and High, aligned with FedRAMP Rev. 5 baselines.

Do I need a 3PAO?

For Ready and Authorized statuses, yes; 3PAOs must be A2LA accredited and FedRAMP recognised.

How fast must vulnerabilities be fixed?

POA&M items must be remediated within 30 days for high, 90 days for moderate and 180 days for low risk.

Is hosting in the US required?

GovRAMP has no geographic hosting requirement at Low or Moderate, but state laws and contracts may impose one.

Is GovRAMP required by law?

No. It is required through individual government procurements and policies.

How long does a GovRAMP status last?

Verified statuses are maintained through continuous monitoring and annual assessments; a Security Snapshot is valid for 12 months.

What is TX-RAMP?

The Texas Risk and Authorization Management Program, a separate state programme for cloud services used by Texas agencies.

Can offshore teams work on a GovRAMP product?

Often yes at Low and Moderate, subject to contract terms, but access controls, data location and personnel arrangements must be documented, and High impact data may restrict foreign access.

What is the Authorized Product List?

GovRAMP's public list of products with verified statuses, which governments check during procurement.