GovRAMP (formerly StateRAMP) Compliance

Who This Applies To

• SaaS, PaaS, and IaaS companies selling cloud services to state agencies, municipalities, public universities, K-12 districts, or tribal governments

Current Status (as of July 2026)

The organization rebranded from StateRAMP to GovRAMP on February 14, 2025 (the legal entity remains StateRAMP; the program operates as GovRAMP). Built on NIST SP 800-53, with authorization levels of Low, Low+, Moderate, and High. A lighter-weight Core tier (60 foundational controls mapped to NIST SP 800-53 and MITRE ATT&CK) launched May 2025 as an accessible entry point for smaller vendors. Participation is voluntary and uneven — roughly half of U.S. states participate at some level, but mandates vary widely; some states (Texas via its own TX-RAMP, North Carolina) have hard procurement mandates, while others have only partial-agency participation. Verify the specific target state's requirements rather than assuming blanket adoption.

What It Covers

The same NIST SP 800-53 control foundation as FedRAMP, scaled to impact level, with a formal authorization pipeline (Ready → Provisionally Authorized → Authorized) validated by accredited third-party assessment organizations.

How FEDCertified™ Helps

Request early access to connect with vetted assessors and cloud security consultants experienced with state and local authorization. Assessment coverage for this framework is planned but not yet live.

Sources

govramp.org; NIST SP 800-53.