Public Documents

StateRAMP recognized FedRAMP authorized third party assessment organizations (3PAOs) to conduct independent audits.

The Appeals Committee serves as the adjudication board for the Program Management Office determinations.

This document provides the security control baselines. All of the security controls listed in the table are outlined in NIST 800-53 Rev. 4. (Retired October 1, 2024)

The Best Practice Guide was created to provide government and industry with consensus-based advice and terms and conditions for cloud solution procurement models.

This document explains the actions taken when a service provider fails to maintain an adequate continuous monitoring program.

Continuous monitoring review procedures outline the process to examine each monthly package.

This document helps service providers and governments determine what StateRAMP security category requirements to use to ensure their data is protected.

In an effort to provide recognition to those providers whose products have achieved a FedRAMP Authorization through Joint Authorization Board (JAB) approval, a new Federal JAB status has been created for providers who wish to list their product on the StateRAMP website.

This guide explains the StateRAMP implementation process for governments.

This document describes the process for StateRAMP stakeholders to use when reporting information concerning information system security incidents or suspected information system security incidents.

To achieve StateRAMP Ready status at a Low Impact Level, a service provider must meet the minimum mandatory requirements outlined in this document.

To achieve StateRAMP Ready status at a Moderate or High Impact Level, a service provider must meet the minimum mandatory requirements outlined in this document.

This charter outlines the duties and responsibilities of the StateRAMP Provider Leadership Council.

To achieve Ready Status for Low Impact levels, a service provider must meet the minimum mandatory requirements outlined in this document. (Rev. 4 – Retired Oct. 1, 2024)

To achieve Ready Status for Moderate/High Impact levels, a service provider must meet the minimum mandatory requirements outlined in this document. (Rev. 4 – Retired Oct. 1, 2024)

This document describes a general governance and security framework for StateRAMP.

…

Learn about sponsoring government eligibility, how to become a sponsor, sponsor commitments, and how the StateRAMP PMO works to serve state and local governments.

The Standards & Technical Committee makes recommendations for best practices and policies that guide cloud security requirements and verification.

This framework for bylaws was developed by the StateRAMP Steering Committee. As the Board of Directors is formed in late 2020, one of their first actions will be to adopt the bylaws for the organization.

This charter outlines the duties and responsibilities of the StateRAMP Approvals Committee and their role in providing approvals for product security packages seeking an Authorized status.

This document provides information about the StateRAMP organization, how to become a member, the process for engaging the PMO to complete a security review, requirements for government sponsorship, and how to list products on the Authorized Product List.

The PMO Charter defines the objectives, roles, and responsibilities associated with the StateRAMP Program Management Office (PMO).

This document provides an updated StateRAMP Program Management Fee Schedule, effective January 1, 2025.

This document outlines the process (including government sponsorship requirements) for a vendor’s offering to be listed as StateRAMP Authorized on StateRAMP’s Authorized Product List (APL).

This document provides a summary of NIST 800-53 Rev. 4 security controls required for verification, by Security Impact Level Category. This summary is the result of ongoing collaboration with State leaders and cybersecurity experts.

The purpose of this charter is to define the objectives, membership, decision making, meeting schedule, and roles and responsibilities associated with the StateRAMP Steering Committee.

When a service provider identifies a vulnerability that potentially warrants different handling than normally required by StateRAMP, they may submit a deviation request to StateRAMP using this form.

This guide describes the requirements for all vulnerability scans provided by service providers to StateRAMP for products with a Ready, Provisionally Authorized, or Authorized status.