Skip to main content
> GovRAMP (formerly StateRAMP)

State Risk and Authorization Management Program

Standardized cybersecurity verification for cloud services used by state and local government

Governing Body: GovRAMP (formerly StateRAMP)
Established: 2021 Last Updated: February 2025 (rebranded to GovRAMP) Scope: U.S. State and Local Government
3
Impact Levels

What is GovRAMP (formerly StateRAMP)?

StateRAMP rebranded to GovRAMP on February 14, 2025 (govramp.org), though the legal entity remains StateRAMP dba GovRAMP. The program provides standardized cybersecurity verification for cloud service providers serving state, local, tribal, and territorial governments, modeled after federal FedRAMP. Security baselines are aligned to NIST SP 800-53 Rev 5 and, for the new Core Status tier (launched May 2025), mapped to the MITRE ATT&CK framework across 60 foundational controls. Authorization levels run from Core and Low through Moderate and High. Vendors searching under either name will find the same program. The Federal JAB Attestations pathway is closing: no new applications after January 1, 2026, with the list retiring June 1, 2026 ([GovRAMP 2026 modernization](https://govramp.org/news/govramp-advances-2026-modernization-and-national-adoption)).

// What is GovRAMP (formerly StateRAMP)?

GovRAMP (formerly StateRAMP) is a nonprofit organization that provides a standardized approach to cybersecurity verification for cloud service providers (CSPs) serving state and local government. On February 14, 2025, the organization rebranded from StateRAMP to GovRAMP (operating as a dba; the legal entity remains StateRAMP). Modeled after the federal FedRAMP program, GovRAMP bridges a critical gap by giving state, local, tribal, and territorial (SLTT) governments a reliable way to evaluate the security of cloud solutions.

CSPs undergo third-party assessment against NIST SP 800-53 Rev 5 controls, with impact levels corresponding to data sensitivity: Low, Moderate, and High. In May 2025, GovRAMP introduced a new Core Status tier covering 60 foundational controls selected based on NIST SP 800-53 Rev 5 and the MITRE ATT&CK framework, giving smaller and emerging vendors an accessible entry point. GovRAMP maintains an Authorized Product List that government entities can reference during procurement.

Note: The Federal JAB Attestations list (which recognized FedRAMP JAB-authorized products) is being retired. No new applications are accepted after January 1, 2026, and the list retires on June 1, 2026.

// Inside GovRAMP (formerly StateRAMP)

GovRAMP defines security requirements using two separate axes. Impact level sets which controls apply, and the Security Assessment Framework defines three: Low, Moderate, and High, each aligned to the matching FedRAMP Rev 5 control baseline. Verification status is how far a provider has progressed through assessment, and Core Status (introduced May 2025) sits at the entry point with 60 foundational NIST SP 800-53 Rev 5 controls selected for MITRE ATT&CK alignment. A provider holds an impact level and a status at the same time, so read the two together when evaluating a vendor.

1

GovRAMP Core Status (verification status, not an impact level)

Introduced May 2025. A verified security designation for cloud providers not yet ready for full authorization. Covers 60 foundational NIST SP 800-53 Rev 5 controls selected based on MITRE ATT&CK framework alignment.

Control Baseline

60 moderate-impact controls across 11 control families, chosen for alignment with the most critical attack vectors in MITRE ATT&CK.

Use Cases

Smaller and emerging cloud vendors seeking an accessible entry point into government procurement before pursuing full GovRAMP authorization.

2

GovRAMP Low

Baseline security verification for cloud systems processing non-sensitive government data.

Control Baseline

Subset of NIST SP 800-53 Low controls addressing fundamental security practices.

Use Cases

Public-facing websites, non-sensitive collaboration tools, open data platforms.

3

GovRAMP Moderate

Full security verification for systems processing sensitive government data including PII.

Control Requirements

Full NIST SP 800-53 Rev 5 Moderate baseline with GovRAMP-specific parameters for state and local government context.

Use Cases

Systems processing PII, financial data, health information, law enforcement records.

Continuous Monitoring

Monthly vulnerability scanning, annual penetration testing, and ongoing Plan of Action and Milestones (POA&M) management.

4

GovRAMP High

Most rigorous verification level for systems processing the most sensitive state and local government data.

Enhanced Controls

Full control set including advanced encryption, stringent access controls, and enhanced incident response.

Use Cases

Criminal justice systems, critical infrastructure, emergency services, highly sensitive PII.

Note: GovRAMP uses FedRAMP reciprocity. CSPs with an existing FedRAMP authorization can achieve GovRAMP verification through a streamlined process. GovRAMP publishes an Authorized Product List that government procurement teams reference during vendor evaluation. Note: the Federal JAB Attestations pathway is closing (no new applications after Jan 1, 2026; list retires Jun 1, 2026) following FedRAMP's retirement of the JAB in 2024.

// Who Must Comply

  • 1 Cloud service providers selling to state government agencies
  • 2 SaaS vendors serving local government and municipalities
  • 3 Cloud providers serving K-12 school districts
  • 4 Technology vendors in states that have adopted GovRAMP (formerly StateRAMP) requirements
  • 5 Government IT departments evaluating cloud procurement
  • 6 Managed service providers hosting government workloads

// Key Requirements

Access Control

Role-based access, multi-factor authentication, and least privilege enforcement

Continuous Monitoring

Ongoing vulnerability management, configuration monitoring, and security event detection

Data Protection

Encryption at rest and in transit with key management procedures

Incident Response

Incident response plan, notification procedures, and breach reporting capabilities

Third-Party Assessment

Independent assessment by a GovRAMP-approved 3PAO against applicable control baseline

POA&M Management

Plan of Action and Milestones tracking for identified control gaps with defined remediation timelines

// Enforcement & Penalties

GovRAMP itself does not impose fines, but failure to achieve or maintain verification can disqualify cloud providers from state and local government contracts. In states that have formally adopted GovRAMP, non-compliance effectively blocks market access.

Maximum Penalty

Disqualification from state and local government contracts

Examples:

  • Removal from GovRAMP Authorized Product List
  • Loss of eligibility for government contracts in adopting states
  • Contract termination for lapsed verification status
  • Reputational impact in government procurement evaluations

// Cyber Insurance Impact

GovRAMP verification demonstrates security maturity based on NIST SP 800-53 Rev 5 standards, which can positively influence cyber insurance underwriting. Cloud providers with GovRAMP authorization may benefit from lower premiums due to validated security controls and continuous monitoring practices.

// How Breach Craft Helps

We help organizations achieve GovRAMP (formerly StateRAMP) compliance through genuine security improvements, not checkbox exercises. Our services address the specific requirements and challenges of GovRAMP (formerly StateRAMP).

Gap Assessment

Measure your security against industry standards.

Learn more

Penetration Testing

Find the gaps before attackers do.

Learn more

Virtual CISO

Executive security leadership on demand.

Learn more

Vulnerability Assessment

Thorough security scanning and risk prioritization.

Learn more

// Common Questions

What is StateRAMP, and why is it now called GovRAMP?
StateRAMP and GovRAMP are the same program under two names. The nonprofit rebranded on February 14, 2025; the legal entity remains StateRAMP, operating as GovRAMP. It gives state, local, tribal, and territorial governments, along with K-12 districts and higher education institutions, one standard way to verify the security of a cloud product before buying it. Cloud service providers are assessed against NIST SP 800-53 Rev 5 controls and then listed on the public Authorized Product List that procurement teams search. The model is verify once, serve many: a provider does the security work a single time instead of answering a separate questionnaire for every agency it sells to.

What are the GovRAMP (StateRAMP) requirements for a cloud service provider?
First classify your product's data to select an impact level, which sets the NIST SP 800-53 Rev 5 control baseline you have to meet. Then assemble the security package: a System Security Plan, boundary diagram, asset inventory, roles and permissions matrix, policies and procedures, and a Plan of Action and Milestones (POA&M) for every open gap. A GovRAMP-approved third-party assessment organization (3PAO) audits the controls and issues a Readiness Assessment Report or Security Assessment Report, and the GovRAMP Program Management Office validates the package independently. Keeping the status means continuous monitoring: vulnerability scans at least monthly, a monthly executive summary, monthly POA&M updates, and an annual 3PAO assessment covering roughly a third of the controls. The GovRAMP Security Assessment Framework spells out each step.

What are the four GovRAMP verified statuses?
Core, Ready, Provisionally Authorized, and Authorized. All four appear on the Authorized Product List. Core is the entry point: 60 foundational controls, validated by the GovRAMP Program Management Office instead of a 3PAO, with quarterly continuous monitoring. Ready means a 3PAO has attested in a Readiness Assessment Report that the product meets the minimum mandatory controls. Provisionally Authorized and Authorized both require a full 3PAO Security Assessment Report plus a sponsoring government. What separates them is remediation: a Provisionally Authorized product meets the bar with limited items still open on its POA&M, while an Authorized product satisfies every requirement. GovRAMP also publishes in-progress markers (Progressing, In Process, Pending) so buyers can see which vendors are working toward a status.

How is GovRAMP different from FedRAMP?
The buyer, mostly. FedRAMP authorizes cloud services for federal agencies; GovRAMP does the same job for state, local, tribal, territorial, and education buyers. Both build on NIST SP 800-53 Rev 5, so the underlying work overlaps heavily. GovRAMP Fast Track requires no new audit for a product holding FedRAMP Ready, ATO, or P-ATO status: you submit the same 3PAO audit and security package to the GovRAMP PMO, even before your FedRAMP review finishes. Recognition now runs the other direction too. In July 2026 FedRAMP updated its Class A rules so that a GovRAMP assessment completed within the previous 12 months can satisfy the approved alternative security framework prerequisite. Our FedRAMP guide covers the federal side.

Does GovRAMP require penetration testing?
Yes, for the 3PAO-assessed statuses. The GovRAMP Security Assessment Framework requires penetration tests for the initial review at Ready and Authorized, and again to meet continuous monitoring reporting requirements. GovRAMP publishes separate Penetration Test Guidance covering how to plan, execute, and report the test, and the engagement has to match the authorization boundary you documented in your System Security Plan. Core status providers may submit a penetration test but are not required to. Findings flow into the POA&M with remediation timelines that the PMO and your sponsoring government track month over month. Our penetration testing service maps findings to the control families your assessor will review, so the report doubles as evidence in your security package.

Is GovRAMP mandatory?
Not nationally. GovRAMP is a nonprofit program, not a statute, and it issues no fines. What it decides is whether you can sell. States write GovRAMP status into their procurement policy, and once a state does, a missing authorization disqualifies your product from the bid. Arizona moved its AZ-RAMP program to GovRAMP in April 2025, North Carolina signed on in February 2026, and Nevada followed in March 2026. Texas runs its own TX-RAMP and grants reciprocity to GovRAMP. As of this review, 73 government organizations across 33 states participate, including 32 state-level agencies, so check the states you actually sell into before assuming. A gap assessment shows how far you are from the status a given state expects.

// Related Frameworks

FedRAMP NIST CSF FISMA

// Industries That Need GovRAMP (formerly StateRAMP)

These industries commonly require GovRAMP (formerly StateRAMP) compliance as part of their regulatory obligations.

Government

Guide last reviewed: September 21, 2026

Ready to Strengthen Your Defenses?

Schedule a free consultation with our security experts to discuss your organization's needs.

Schedule Consultation Call Us

Or call us directly at (445) 273-2873