GovRAMP

What is GovRAMP?

GovRAMP gives US governments below the federal level a common way to check the security of the cloud services they buy. It began as StateRAMP, and in 2025 the organisation announced a new name, GovRAMP, to reflect that it serves local governments, schools and other public bodies as well as states. It is a 501(c)(6) nonprofit membership organisation, governed by a board made up mainly of state and local officials.

It does the same kind of job for these governments that FedRAMP does for federal agencies, but it is a separate, independent programme.

Who uses it?

• Governments: state, local, tribal and territorial governments, and higher education institutions. They join free of charge and can rely on a provider’s GovRAMP status in their purchasing.
• Providers of infrastructure, platform or software as a service that handle government data. They pay for membership and assessments.

GovRAMP itself doesn’t make anyone take part. A government’s own procurement rules or contract can require a GovRAMP status, and many are adopting it as a shared yardstick instead of sending every vendor a different questionnaire.

How do the statuses work?

The programme is built on NIST SP 800-53 Revision 5 and offers a ladder of statuses:

• Security Snapshot and Progressing statuses: an early, scored look at a subset of controls, showing a government where a provider stands and that it is working towards verification.
• Core: confirms a set of foundational controls chosen with reference to MITRE ATT&CK and aligned with the moderate impact baseline.
• Ready: an independent assessment showing the provider meets GovRAMP’s minimum mandatory requirements.
• Provisionally Authorized: meets the authorisation requirements but relies on connected services that aren’t yet GovRAMP or FedRAMP authorised.
• Authorized: the highest status, showing all required controls for the service’s impact level are in place.

Higher statuses are assessed by a third-party assessment organisation (3PAO), accredited to ISO/IEC 17020 and recognised by FedRAMP. GovRAMP’s programme management office reviews the package, and for authorisation a sponsoring government’s authorising official signs off.

What happens after verification?

Continuous monitoring starts as soon as a status is awarded. Providers send monthly and quarterly reports, have an annual assessment by a 3PAO, and must fix open findings within set times: 30 days for high risks, 90 for moderate and 180 for low.

How does it relate to FedRAMP?

The two share the same control catalogue and the same pool of accredited assessors, so a provider with FedRAMP work behind it is well placed. They remain separate programmes with separate decisions, though: check GovRAMP’s current documents for how existing FedRAMP packages can be reused. Using a GovRAMP-authorised platform also doesn’t make the software built on it compliant; each layer is assessed, and controls it inherits from the platform are documented in its package.

For public safety software, GovRAMP sits alongside the CJIS Security Policy, which applies whenever the service handles criminal justice information.