StateRAMP / GovRAMP Guide: Authorisation for State and Local Cloud Services

State, local, tribal and education buyers need a consistent way to judge the security of cloud products, and most of them cannot run a FedRAMP-style assessment for every contract. StateRAMP was created to fill that gap and, since February 2025, operates as GovRAMP. It gives providers a ladder of verification statuses, from a confidential Security Snapshot score to full Authorized status assessed by an independent assessor, all built on NIST SP 800-53 Rev. 5 controls. This guide explains the statuses as GovRAMP describes them in October 2026, what evidence each one needs, where identity and non-human identity controls sit, and how GovRAMP relates to FedRAMP. It is written for cloud providers selling to the US public sector and for the government security and procurement teams who rely on the results. It does not repeat the federal programme: see the FedRAMP Guide for that.

Key takeaways

• Same organisation, new name. StateRAMP announced on 14 February 2025 that it would operate as GovRAMP; the legal name remains StateRAMP and existing statuses stayed active.
• Five steps on one ladder. Security Snapshot and Progressing Snapshot (40 controls), Core (60 controls, PMO review), Ready (80 controls, 3PAO) and Authorized or Provisional (300+ controls, 3PAO).
• Verify once, use many. A product verified once can be reused across many government procurements instead of a fresh security questionnaire per contract.
• Fast Track reuses federal work. Providers with FedRAMP-style SARs, RARs and continuous monitoring data can submit them for PMO gap review instead of starting again.
• Status is not permanent. Core needs quarterly continuous monitoring; Ready and Authorized need monthly monitoring, an annual 3PAO assessment and POA&M remediation within 30, 90 or 180 days.

What it is and who it applies to

GovRAMP is a 501(c)(6) nonprofit membership organisation. Its stated purpose is to standardise cloud security for state, local, tribal and education governments, with a risk-based path for governments and providers to verify, adopt and maintain secure cloud solutions. In its rebrand announcement the organisation said the old name no longer captured the scope of its mission, which now spans state, local, tribal, education and federal participants. It now operates under the GovRAMP name as a "doing business as" name, while contracts, memberships and verifications made under the StateRAMP name continue.

GovRAMP is not a law. A provider has to meet it only when a government buyer requires it, usually through solicitation or contract language. GovRAMP's procurement toolkit supplies standard solicitation and contract wording and a data classification decision framework, so the level a buyer asks for should follow the sensitivity of the data the service will hold.

• Cloud service providers: SaaS, PaaS and IaaS vendors selling to state and local agencies, public universities and school systems. Membership is required before any verification work starts.
• Government members: agencies that use the verified product lists and, for Authorized packages, act as sponsors. Government membership is free.
• The PMO: the programme management office is run by RAMPQuest. It reviews documentation, validates scan results and audit findings, issues statuses and oversees continuous monitoring.
• Third-party assessment organisations (3PAOs): independent assessors required for Ready and Authorized. GovRAMP's FAQ says they must be A2LA-accredited to ISO/IEC 17020:2012 and FedRAMP-recognised. The provider chooses and pays the 3PAO.

GovRAMP reports more than 1,200 member organisations, more than 70 engaged government organisations and more than 330 products in the programme (figures from govramp.org, October 2026).

Where GovRAMP stops and FedRAMP starts

Structure and key requirements

The verification ladder is the core of the programme. Each step uses more controls and stronger independent verification, and the lower steps are designed to lead to the higher ones.

Control counts are as GovRAMP's security programme page states them in October 2026. The Authorized and Progressing product lists have been combined into a single Program Participants list.

Snapshot and Progressing Snapshot

• Scoring: the Security Snapshot criteria are based on NIST SP 800-53 Rev. 5 baselines and weighted by MITRE ATT&CK control protection values, so controls that defend against more techniques score more points.
• Confidentiality: the PMO sends the score in a letter to the provider; it is not published, and the provider decides whether to share it with a buyer.
• Progressing list rules: from 1 January 2026 a product needs a score above zero to be listed, and must show active improvement between quarterly reports. Stagnant or falling scores trigger an informal discussion, then a formal remediation notice, then removal with notice to government partners.
• Extra credit: hosting on a GovRAMP Authorized IaaS, recognised compliance frameworks, penetration testing and strong security training can raise the Progressing score.
• Texas: GovRAMP says Progressing Snapshot enrolment qualifies a product for TX-RAMP Provisional status without the usual 18-month expiry.

Core

Core is the entry-level verified status, aimed at small and mid-sized providers. The PMO assesses 60 controls aligned to the NIST SP 800-53 Rev. 5 Moderate baseline, which GovRAMP says were selected using the MITRE ATT&CK framework. It is not a self-attestation: the PMO analyses documentation, validates scan results and reviews overall programme posture, but no 3PAO audit is needed.

Ready, Provisional and Authorized

• Ready: confirms the product meets GovRAMP's minimum mandatory requirements through an independent 3PAO assessment, documented in a Readiness Assessment Report (RAR) or a Security Assessment Report (SAR).
• Authorized: full compliance with all required controls for the chosen impact level (Low, Moderate or High), with no outstanding dependencies. Products that also hold a federal JAB authorisation are shown as "Authorized, Federal JAB".
• Provisional: the product meets Authorized requirements but depends on interconnected technology that is not yet GovRAMP or FedRAMP verified. Those dependencies must have a current Security Snapshot, and limited items may sit on the POA&M until they are resolved.
• Sponsorship: a sponsor is a CIO or designee at a state, local, tribal or territorial government or a public higher education institution, who must first be an Individual Government Member. Providers without a sponsor can use the GovRAMP Approvals Committee.
• Data location: GovRAMP sets no geographic hosting requirement for Low or Moderate data, though state and local rules may. High impact data may carry restrictions on foreign nationals, contractors and access locations.

Identity and NHI requirements

GovRAMP does not publish a separate identity standard: identity requirements come from the NIST SP 800-53 Rev. 5 controls in each package. The access control (AC) and identification and authentication (IA) families are where assessors spend most of their time, and for cloud services the non-human side is often the weaker part of the evidence. Which enhancements apply depends on the status and impact level, so check the GovRAMP template for your level rather than assuming.

• Service and integration accounts: the SSP should list every non-human account that can reach government data, what it can do, who owns it and how its credential is rotated. See the Service Account Security Guide.
• API keys and tokens issued to customers: state agencies integrate SaaS products with their own systems. Document how customer API keys are scoped, expired and revoked, and how a tenant admin sees which keys exist.
• Vendor support access: remote support tooling with standing credentials is a real path into government systems. The BeyondTrust breach, where a stolen Remote Support SaaS API key led to a major incident at the US Treasury, is the case to point to when justifying tight scoping of support keys.
• Secrets storage: show where secrets live and who can read them. See the Secrets Management Guide.

Implementation steps

1. Classify the data and pick a target. Use GovRAMP's data classification tool with your first government customer to agree the impact level (Low, Moderate or High) and the status they need. Do not aim for Authorized if the buyer only needs Core.
2. Join and get a baseline score. Become a member, request a Security Snapshot, attend the one-hour intake meeting and upload evidence within 28 days. GovRAMP says results usually arrive in about three weeks.
3. Fix the cheap, high-weight gaps. Because the score is weighted by ATT&CK protection values, MFA, privileged access, logging and vulnerability scanning gaps usually move the score most. Enrol in the Progressing Snapshot if you need a public listing while you improve.
4. Write the package. Core and Ready both need an SSP, system diagrams, policies and procedures (configuration management, incident response and contingency plans), a user guide, rules of behaviour, a plans catalogue, 90 days of continuous monitoring data and a POA&M.
5. Decide on Fast Track. If you already hold FedRAMP or similar federal documentation, submit the SAR, RAR and ConMon data with your 3PAO through a Security Review Request. The PMO accepts FedRAMP formatting and works with you on gaps; fees are the same as the standard route.
6. Engage a 3PAO for Ready or Authorized. Confirm the 3PAO is on GovRAMP's participating assessor list. GovRAMP gives six to twelve months after engaging a 3PAO as typical for Authorized.
7. Obtain a sponsor. For Authorized or Provisional, line up a government sponsor early, or plan to use the Approvals Committee.
8. Run continuous monitoring from day one. Monitoring begins when a status is awarded. Build monthly scan, POA&M and inventory reporting into operations before submission so the first months do not fail.

Rolling back: if a significant change or failed remediation puts a status at risk, GovRAMP expects the 3PAO to evaluate significant changes. Plan changes (new regions, new third-party services, identity provider swaps) through change control with the 3PAO involved, rather than discovering at the annual assessment that the boundary moved. A service that slips can fall back to a lower status while it fixes the gap; that is better than a lapsed listing.

Evidence and assessment

• POA&M deadlines: GovRAMP's FAQ sets remediation at 30 days for high, 90 days for moderate and 180 days for low findings.
• Reporting cadence: providers submit monthly and quarterly reports to the PMO, complete annual assessments with an approved 3PAO, and have significant changes evaluated by the 3PAO.
• Who sees ConMon: participating governments can request access to a provider's ConMon profile with the provider's approval.
• Fees: PMO fees are tiered by provider revenue (under $1M, $1M to $5M, over $5M) and are separate from 3PAO costs. For example, GovRAMP lists monthly continuous monitoring at $268, $537 or $1,073. Check the pricing overview for current figures before budgeting.

Measuring whether the programme is working

• Snapshot or Progressing score trend quarter on quarter.
• POA&M items closed within the 30/90/180 day windows, as a percentage.
• Monthly ConMon submissions made on time (target 100 percent).
• Percentage of non-human accounts in the boundary with a named owner and a rotation date.
• Privileged and support access sessions covered by MFA and logged (target 100 percent).
• Number of procurements where the existing status was accepted without a separate questionnaire.

Mapping to other frameworks

For buyers, GovRAMP is a third-party risk tool. A verified status reduces questionnaire work, but it does not replace contract terms on breach notification, data return or subcontractors. See the Third-Party Risk Management Guide.

Choosing a status: small and large providers

• Small provider, low-sensitivity data: start with a Snapshot, then Core. Core needs no 3PAO, which removes the largest single cost.
• Provider with a FedRAMP package: go straight to Fast Track; rebuilding evidence wastes months.
• Provider handling sensitive or regulated data at scale: buyers will usually require Ready or Authorized at Moderate. Budget for the 3PAO and a monthly ConMon team.
• Product built on unverified sub-processors: expect Provisional rather than Authorized until those dependencies hold their own status.
• Buyer with a small IT team: rely on the Program Participants list and request ConMon access for critical services rather than running your own assessments.

Common pitfalls

• Treating the Snapshot score as a certification. It is a confidential maturity score, not a verified status. Buyers should ask which status a product holds, at which impact level.
• Boundary that leaves out non-human access. CI/CD pipelines, support tooling and integration accounts that touch production data are often missing from the SSP. Assessors find them in the logs, and the fix becomes a POA&M item.
• Standing vendor support credentials. Long-lived support API keys with broad reach are what turned the BeyondTrust breach into a government incident. Scope, expire and log them.
• Letting ConMon slip after the award. Progressing listings can be removed for stagnant scores, and missed monthly reporting puts a status at risk. Staff it as an operational process.
• Assuming Provisional is a near-final state. It depends on dependencies outside your control; track their verification status and plan replacements if they stall.
• Using old StateRAMP references. Contract templates and policies may still say StateRAMP. That is legally fine because the legal name is unchanged, but update wording to avoid confusion in evaluations.

Practitioner checklist

• Agree the impact level and required status with the buyer using GovRAMP's data classification tool.
• Join GovRAMP and obtain a Security Snapshot score before committing to a 3PAO.
• Inventory every human, privileged and non-human account in the boundary, with owner and rotation date.
• Enforce MFA on all privileged, support and administrative access paths, including break-glass.
• Prepare SSP, diagrams, policies, rules of behaviour, plans catalogue and 90 days of ConMon data.
• Check Fast Track eligibility if you hold FedRAMP or similar federal documentation.
• Choose a 3PAO from GovRAMP's participating assessor list and line up a sponsor early.
• Set POA&M processes to the 30, 90 and 180 day windows and report monthly.
• Route significant changes through the 3PAO before they go live.

Standards and references

• GovRAMP: Security Program
• GovRAMP: Frequently Asked Questions
• GovRAMP: Authorized and Provisional Verification
• GovRAMP: Core Verification
• GovRAMP: Progressing Security Snapshot Program
• GovRAMP: Fast Track Program
• GovRAMP: StateRAMP Announces Rebrand to GovRAMP
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: FedRAMP Guide · NIST SP 800-53 Guide · Public Sector Identity Security Guide · Third-Party Risk Management Guide. This guide summarises the GovRAMP (formerly StateRAMP) programme as published on govramp.org in October 2026 and is not legal advice.