StateRAMP Frequently Asked Questions

Technology (NIST) in the Special Publication 800-53 Revision 4. The controls outlined in the NIST SP 800-53 Revision 4 address all major known security risks for information systems and cloud systems.

State and local governments may require service providers to engage with StateRAMP and obtain a StateRAMP security status at any time. Service providers are encouraged to seek a StateRAMP Ready status independent of any RFP publication.

Six security statuses are recognized on the Authorized Product List (APL).

Verified Offerings: Ready, Authorized, and Provisional

To be verified, the provider must meet minimum security requirements and provide an independent audit conducted by a third party assessing organization (3PAO). StateRAMP recognizes three verified statuses, including Ready, Provisional, and Authorized. Ready meets minimum requirements; Provisional exceeds minimum requirements and includes a government sponsor; Authorized satisfies all requirements and includes a government sponsor. View more about the requirements at www.stateramp.org/templates-resources.

Progressing Offerings: Active, In Process, and Pending

StateRAMP recognizes offerings in the process of working toward a verified offering. To be listed in progress, the provider must be engaged with a third party assessing organization (3PAO) for an independent audit. The in progress statuses include: Active, In Process, and Pending. Active is working toward Ready; In Process is working toward Authorized; Pending has submitted a security package to the Program Management Office (PMO) and is awaiting a determination for a verified status.

StateRAMP Ready status and StateRAMP Authorized status are two different statuses service providers can obtain at different stages in the StateRAMP verification process. Service providers with a StateRAMP Ready status must still undergo additional security and system validation while service providers with a StateRAMP Authorized status have completed all security and system validation and the government has accepted the provider’s completed Security Package.

Provisional status may be assigned by a sponsoring state if the provider meets the mandatory minimum requirements and has submitted a security package for Authorization consideration but is found to meet most but not all security requirements. Providers with a Provisional Status comply with continuous monitoring requirements and submit further documentation in order to obtain Authorization. 

State and local governments can review a list of all service providers registered with StateRAMP and their current security status by visiting the Authorized Product List. Governments may contact our Government Engagement Team at get@stateramp.org to learn more about how to gain access to a service provider’s continuous monitoring and reporting, which is always provisioned by providers.

No, using an infrastructure with a StateRAMP Authorized status does not automatically make the service provider’s system StateRAMP compliant. Each layer (e.g. IaaS, PaaS, and SaaS) must be evaluated on its own for the provider to obtain a StateRAMP Authorized status. However, when the software sits on an infrastructure with a StateRAMP Approved status, it will inherit all security controls from the system with the Authorized status and this can be included and explained in the service provider’s documentation.

A service provider may execute “on the spot” fixes during an assessment conducted by the 3PAO. However, these changes should still be reported in the StateRAMP Security Assessment Report (SR-SAR) and discovered, addressed, and verified by the 3PAO.

Any 3PAO certified by the American Association of Laboratory Accreditation (A2LA) to the requirements of ISO/IEC 17020:2012 Requirements for the Operations of Various Types of Bodies Performing Inspection and accepted by FedRAMP is an accepted StateRAMP 3PAO. More information on becoming an accredited 3PAO may be found on the A2LA website.

Service providers pursing a StateRAMP Ready status are responsible for contracting with and paying for the 3PAO of their choice. The payment of a 3PAO once a service provider has contracted with a State is determined by the State, though typically the service provider pays for the remaining 3PAO assessment.

The A2LA certification ensures 3PAO independence is maintained regardless of who pays for the assessment(s).

Yes. A service provider may partner with any 3PAO or consulting firm to prepare for the StateRAMP assessment.

Only Security Packages and assessment results submitted by an approved StateRAMP 3PAO will be considered when assigning StateRAMP security status.

Partnering with a non-accredited 3PAO prior to the approved 3PAOs assessment does not guarantee the approved 3PAO will validate the service provider’s solution

Service providers must work with a StateRAMP approved 3PAO for annual assessments of its system and to evaluate the impact of some significant changes made by the service provider to its system, platform, and/or service offering.

As part of the StateRAMP requirements, state and local governments are responsible for reviewing and approving the continuous monitoring reports and activities submitted by all service providers monitored by the StateRAMP PMO.

The service provider is responsible for submitting monthly and quarterly reporting to the StateRAMP PMO and partnering with the 3PAO of their choice to submit an annual security assessment. Governments have ultimate responsibility over the ongoing approval of a StateRAMP Authorized status for the providers SaaS, IaaS, or PaaS solution used by the government.

A service provider has 30 days for remediating high POA&M items, 90 days for remediating moderate POA&M items, and 180 days to remediate low POA&M items.

No! If a service provider is unable to secure a government sponsor, they can leverage the StateRAMP Approvals Committee. Committee members serve as authorizing officials on behalf of government 

Eligible sponsors include any government official or employee who serves in the role of Chief Information Officer, or their designee, who represents state, local, tribal, or territorial government or public higher education institutions. Interested sponsors must first become a StateRAMP Individual Government Member. 

StateRAMP recently announced a new early-stage maturity assessment tool for cloud products.  The StateRAMP Security Snapshot was approved by the StateRAMP Standards and Technical Committee and adopted by the Board as a “pre-Ready” measurement and gap analysis to provide insights for providers and the governments they serve. 

The intent of the security snapshot criteria is to offer providers a first step toward achieving a verified StateRAMP Security status. The criteria are designed to provide a gap analysis, that goes beyond self- attestation to validate a product’s current maturity in relation to meeting the Minimum Mandatory Requirements for StateRAMP Ready, including controls and select additional requirements that would have a significant impact on the state of the system. A letter is provided with the StateRAMP Security Snapshot Score. Scores are not posted on the Authorized Product List. 

The updated fee schedule can be found on our Documents page. The Board adopted updating pricing for security reviews and continuous monitoring based on company size by revenue. 

There is not a data or system geographical requirement for StateRAMP or FedRAMP low or moderate standards. There are requirements in High classifications around foreign nationals and contractors. It is generally recommended that companies that wish to do business with US-based government entities have that data and systems in the US. Many governments and individual agencies have restrictions beyond what StateRAMP requires, and once that data is classified within other compliance rules, such as with HIPAA, there are further restrictions. Many state governments require data to reside in the US and even systems maintenance to be performed by individuals residing in the US. If you have further questions, please email info@stateramp.org.