Reach GovRAMP Core verification with evidence ready for PMO review

GovRAMP Core is a verified security status from GovRAMP, the non-profit formerly called StateRAMP. It confirms that a cloud product has implemented 60 priority NIST SP 800-53 Rev. 5 controls, selected using the MITRE ATT&CK framework and aligned to the Moderate baseline. The GovRAMP PMO assesses it directly, and approved products are listed on the Authorized Product List as Core-verified.

No. GovRAMP Core does not require an assessment by a third-party assessment organisation (3PAO). The GovRAMP Program Management Office reviews your submitted evidence directly, including documentation analysis, validation of scan results and an evaluation of your overall security programme. Core is not a self-attestation, though: you must submit evidence for review.

You submit evidence for all 60 Core controls plus required documentation. GovRAMP lists a System Security Plan, system diagrams, policies and procedures, a user guide, rules of behaviour, a plans catalogue, applicable laws and regulations, and 90 days of continuous monitoring data with a plan of action and milestones (POA&M). You must be a GovRAMP member before submitting.

The Progressing Security Snapshot shows early progress and security maturity, while Core formally verifies that 60 foundational controls are implemented. Core results in a listing on the Authorized Product List and requires quarterly continuous monitoring. Many providers use the Snapshot first to build readiness, then apply for Core, although the Snapshot is optional.

GovRAMP Core is a lower-cost, PMO-assessed status that can be a destination in its own right for lower-risk contracts, or a stepping stone towards GovRAMP Ready or Authorized. Ready and Authorized require a 3PAO assessment against a full impact level baseline and monthly continuous monitoring, whereas Core covers 60 controls with quarterly monitoring.

Cloud and technology providers selling to US state and local governments that accept GovRAMP Core need it when a contract asks for it. GovRAMP has named states such as Arizona, Utah and Texas as showing interest. Requirements vary by buyer, so check each solicitation to see whether Core, Ready or Authorized status is required.

Yes, partly. GovRAMP Core uses NIST SP 800-53 Rev. 5 controls, the same catalogue behind FedRAMP, so work done for FedRAMP or NIST-based programmes overlaps heavily. ISO 27001 is a separate standard, but many of its Annex A controls, such as access control, logging and backups, cover similar ground and can share evidence.

Yes. GovRAMP Core is supported in OneClickComply today. OneClickComply maps the 60 Core controls to your existing controls, collects evidence automatically and generates the policies the PMO expects. OneClickComply does not issue GovRAMP verification: the GovRAMP PMO reviews your submission and decides on Core status.