Map your GovRAMP Low+ controls and plan your next status with clarity

GovRAMP Low+ is the former StateRAMP Category 2 impact level. It combined the NIST SP 800-53 Low baseline with selected Moderate controls, giving state and local governments an option between Low and Moderate. It was defined under NIST SP 800-53 Rev. 4. GovRAMP's current Security Assessment Framework now uses three impact levels, Low, Moderate and High, based on FedRAMP Rev. 5 baselines.

No, GovRAMP's current Security Assessment Framework defines only Low, Moderate and High impact levels, each aligned to the matching FedRAMP Rev. 5 baseline. Low+ belonged to the earlier StateRAMP Rev. 4 baselines. Providers with a Low+ history should check with the GovRAMP PMO and their government customers which current level applies to their product before planning a new assessment.

Low+ sat between the two. It included every Low baseline control plus selected Moderate controls and enhancements, such as stronger authentication, boundary protection and incident handling, without requiring the full Moderate baseline. Under the current framework, a product is categorised as Low, Moderate or High using GovRAMP's data classification tool, based on the data it processes, stores or transmits.

Low+ was used by cloud providers selling to US state and local governments whose data warranted more protection than Low but not the full Moderate baseline. It was a procurement requirement set by government buyers, not a law. Today, government customers specify a current GovRAMP impact level and status, so providers with Low+ history should confirm the level their contracts now require.

GovRAMP is modelled on FedRAMP and uses NIST SP 800-53 controls, but it serves US state, local and other public sector buyers rather than federal agencies. GovRAMP's current impact levels align to FedRAMP Rev. 5 Low, Moderate and High baselines, and it publishes a federal overlay to help providers reuse FedRAMP work. Low+ had no direct FedRAMP equivalent.

GovRAMP status is verified through an independent assessment by an approved Third Party Assessment Organization (3PAO), reviewed by the GovRAMP Program Management Office. Verified statuses include Core, Ready, Provisionally Authorized and Authorized. Authorized is the highest and requires a full security package, including a System Security Plan, a Security Assessment Report and penetration testing.

They overlap but are not interchangeable. GovRAMP uses prescriptive NIST SP 800-53 controls assessed by a 3PAO, while ISO 27001 is a certifiable management system standard and SOC 2 is an attestation report. Much of the evidence, such as access reviews, logging, change control and incident response, can support all three when controls are mapped once.

GovRAMP Low+ is mapped in OneClickComply's control library and available on request, rather than live as a ready-made framework. That mapping helps providers see which controls they already meet and plan a move to a current GovRAMP Low or Moderate level. OneClickComply does not issue GovRAMP statuses; those come from 3PAO assessment and GovRAMP review.