Navigate the GovRAMP programme from first snapshot to Authorized

GovRAMP is a US nonprofit membership organisation, formerly called StateRAMP, that runs a standardised security verification programme for cloud products used by state, local, tribal and territorial governments and public education. Providers are assessed against controls from NIST SP 800-53 Rev. 5, and verified products are listed on GovRAMP's Authorized Product List so government buyers can reuse one assessment instead of running their own.

Yes. StateRAMP changed its name to GovRAMP in 2025 to reflect its wider role across all levels of government. It is the same programme and the same organisation, so older contracts, RFPs and procurement documents that still say StateRAMP generally refer to the same security requirements and verification statuses.

GovRAMP is not a law, but it becomes a contractual requirement when a participating government or university writes it into procurement. Many states, counties, cities and education bodies now ask cloud providers to hold, or be progressing towards, a GovRAMP verified status. Texas runs its own TX-RAMP programme, which recognises GovRAMP verified status through reciprocity.

GovRAMP has three verified pathways. Core is a PMO-validated status covering 60 prioritised NIST controls with no 3PAO assessment. Ready is based on an independent 3PAO assessment of 80 controls. Authorized, or Provisionally Authorized, is based on a 3PAO assessment of 300+ controls and needs a government sponsor or the GovRAMP Approvals Committee. Authorized requirements are set by impact level: Low, Moderate or High.

Both programmes are built on NIST SP 800-53 Rev. 5, use independent 3PAO assessments and require continuous monitoring. FedRAMP is run by the US General Services Administration for federal agencies, while GovRAMP is an independent nonprofit serving state, local and education buyers. Providers with existing federal documentation can use GovRAMP Fast Track to have it reviewed rather than repeating a full assessment.

GovRAMP does not accept ISO 27001 or SOC 2 in place of its own assessment, but much of the underlying work overlaps: access control, logging, incident response, change management and risk assessment all appear in each. Organisations that already hold ISO 27001 or a SOC 2 report usually have policies and evidence they can reuse when preparing a GovRAMP security package.

Become a GovRAMP member, decide which pathway and impact level fit your government customers, then prepare a security package including a System Security Plan and supporting documentation. Ready and Authorized require an assessment by a GovRAMP approved 3PAO, and Authorized needs government sponsorship. After verification you must keep the status current through continuous monitoring and an annual review.

Yes. OneClickComply supports GovRAMP today. Controls you already run for frameworks such as ISO 27001 or SOC 2 are mapped to GovRAMP requirements, so the same evidence counts towards both. Automated evidence collection and continuous monitoring keep your package current, and our audit team can help you prepare. OneClickComply does not issue GovRAMP authorisations.