StateRAMP

What is StateRAMP?

StateRAMP is the legal name of GovRAMP, a US nonprofit programme that standardises cloud security verification for state, local, tribal and education governments. GovRAMP publishes the framework, built on NIST SP 800-53 Rev. 5. It applies to cloud providers that sell to those governments and the public bodies that buy from them.

The programme rebranded as GovRAMP on 14 February 2025. The legal name remains StateRAMP, and the rebrand covers state, local, tribal and education governments, so the programme is wider than state-level bodies alone. GovRAMP describes itself as a nonprofit community that gives governments and providers a risk-based route to verify, adopt and maintain secure cloud solutions.

GovRAMP sets the requirements. RAMPQuest, its contracted Program Management Office (PMO), runs the programme day to day. The rules sit in the GovRAMP Security Assessment Framework, version 4.2, adopted by the GovRAMP Board of Directors on 21 April 2026.

Why it matters

A state agency's cloud tender names GovRAMP. Your product has no verified status. The procurement waits while you work out what the programme wants.

StateRAMP matters because one verification can serve many buyers. GovRAMP says its programme reduces duplication and improves consistency across the public sector, so a provider is not assessed from scratch by every agency it sells to. Buyers can look up a product's status on GovRAMP's Program Participants list.

A verified status is evidence a buyer can check. A questionnaire answer is a claim.

Who it applies to

StateRAMP applies to two groups. Cloud providers that sell, or want to sell, to state, local, tribal and education governments are the first. The governments that adopt it in their procurement are the second.

It is not a law. It is a nonprofit programme that providers join and that participating governments may require. In practice it is a procurement or contractual requirement set by each government buyer, so whether StateRAMP is mandatory for you depends on the tender or contract in front of you. GovRAMP tells providers in that position to read the requiring government's own programme guidance.

ISO 27001 and StateRAMP answer different questions. ISO 27001 certifies an organisation's information security management system. StateRAMP verifies a cloud solution against a defined set of NIST SP 800-53 Rev. 5 controls. A provider holding an ISO 27001 certificate should not assume it satisfies a government's StateRAMP requirement without checking that buyer's guidance.

The UK position

StateRAMP is a US programme and has no UK legal force. No UK regime refers to it. A UK firm meets StateRAMP only commercially: when it sells cloud services to US state, local, tribal or education governments and a buyer names the programme in a tender or contract. A UK firm with no such customers has no reason to pursue it.

Key requirements

The Security Program is built on NIST SP 800-53 Rev. 5. It is a progressive pathway from initial maturity to full verification, set out on the GovRAMP Security Program page. The steps are:

1. Membership. The provider joins, which gives access to official templates, resources and PMO guidance.
2. Single Security Snapshot. A one-off, PMO-validated assessment of 40 foundational NIST controls that sets a baseline and shows the gaps.
3. Progressing Security Snapshot. An ongoing programme of quarterly assessments that shows improvement over time.
4. Core. The first verified status, based on 60 prioritised controls aligned to the NIST SP 800-53 Rev. 5 Moderate baseline. The PMO validates it, with quarterly continuous monitoring and no third-party assessment organisation (3PAO).
5. Ready. An independently assessed status based on 80 NIST controls, validated by both a 3PAO and the PMO, with monthly continuous monitoring and an annual assessment.
6. Authorized/Provisional. The highest level, based on 300+ NIST controls, with a 3PAO assessment, PMO validation and the same monitoring as Ready.

Each verified status lasts 12 months. Core is a starting status, not the top of the pathway. A buyer who asks for Ready or Authorized/Provisional is asking for a 3PAO's independent assessment, not PMO validation alone.

Overlays

Two overlays connect StateRAMP to other regimes:

• Federal Overlay. It aligns GovRAMP impact levels with federal standards, including FedRAMP Rev. 5. The aim is to help providers meet state and federal requirements while reducing duplicated effort.
• CJIS-Aligned Overlay. It maps CJIS Policy 6.0 to GovRAMP controls and gives guidance for law enforcement and criminal justice environments.

Roles

• GovRAMP sets the framework, requirements and governance, and runs the membership programme.
• RAMPQuest, as PMO, guides providers and 3PAOs, reviews documentation and validates progress.
• 3PAOs, accredited through A2LA and approved under FedRAMP, carry out the independent assessments that the Ready and Authorized/Provisional levels require.
• Governments decide whether to require verification from the providers they buy from. A government sponsor, a public-sector CISO or their designee, supports the review when a product seeks authorization.

Frequently asked questions