StateRAMP Public Documents

TitleSummaryCategoriesLinkhf:doc_categories
3PAO Accreditation Process

StateRAMP recognized FedRAMP authorized third party assessment organizations (3PAOs) to conduct independent audits.

governance
Appeals Committee Charter

The Appeals Committee serves as the adjudication board for the Program Management Office determinations.

governance
Baseline Controls

This document provides the security control baselines. All of the security controls listed in the table are outlined in NIST 800-53 Rev. 4.

baseline-requirements
Continuous Monitoring Escalation Process

This document explains the actions taken when a service provider fails to maintain an adequate continuous monitoring program.

continuous-monitoring
Continuous Monitoring Guide

Continuous monitoring review procedures outline the process to examine each monthly package.

continuous-monitoring
Data Classification Tool

This document helps service providers and governments determine what StateRAMP security category requirements to use to ensure their data is protected.

baseline-requirements
Data Classification Tool

This document is intended to be used by state governments, procurement officials, and service providers as a tool for determining the appropriate impact level for StateRAMP or FedRAMP security requirements.

government-document
FedRAMP JAB Attestation

In an effort to provide recognition to those providers whose products have achieved a FedRAMP Authorization through Joint Authorization Board (JAB) approval, a new Federal JAB status has been created for providers who wish to list their product on the StateRAMP website.

governance
Get Started With StateRAMP – Government Guide

This guide explains the StateRAMP implementation process for governments.

government-document
Incident Communications Procedures

This document describes the process for StateRAMP stakeholders to use when reporting information concerning information system security incidents or suspected information system security incidents.

continuous-monitoring
Minimum Mandates for Ready Status at Low Impact

To achieve StateRAMP Ready status at a Low Impact Level, a service provider must meet the minimum mandatory requirements outlined in this document.

stateramp-program-document
Minimum Mandates for Ready Status at Moderate and High Impact

To achieve StateRAMP Ready status at a Moderate or High Impact Level, a service provider must meet the minimum mandatory requirements outlined in this document.

stateramp-program-document
Ready Minimum Mandatory Requirements for Low Impact Levels

To achieve Ready Status for Low Impact levels, a service provider must meet the minimum mandatory requirements outlined in this document.

ready-requirements
Ready Minimum Mandatory Requirements for Moderate and High Impact Levels

To achieve Ready Status for Moderate/High Impact levels, a service provider must meet the minimum mandatory requirements outlined in this document.

ready-requirements
Security Assessment Framework

This document describes a general Security Assessment Framework (SAF) for StateRAMP.

baseline-requirements
Significant Change Form Template

Service providers are requirements to submit this completed form to StateRAMP and receive StateRAMP approval prior to implementing a significant change to a system with an existing StateRAMP Authorization.

continuous-monitoring
Sponsoring Government Brochure

Learn about sponsoring government eligibility, how to become a sponsor, sponsor commitments, and how the StateRAMP PMO works to serve state and local governments.

government-document
Standards & Technical Committee Charter

The Standards & Technical Committee makes recommendations for best practices and policies that guide cloud security requirements and verification.

governance
StateRAMP Adopted Bylaws

This framework for bylaws was developed by the StateRAMP Steering Committee. As the Board of Directors is formed in late 2020, one of their first actions will be to adopt the bylaws for the organization.

governance
StateRAMP Approvals Committee Charter

This charter outlines the duties and responsibilities of the StateRAMP Approvals Committee and their role in providing approvals for product security packages seeking an Authorized status.

governance
StateRAMP Continous Monitoring Guide

This document outlines the process and requirements for monthly, quarterly, and annual reporting required for a service provider to maintain a StateRAMP status.

stateramp-program-document
StateRAMP Glossary

This document provides definitions of commonly used terms and abbreviations.

stateramp-program-document
StateRAMP Overview

This document provides information about the StateRAMP organization, how to become a member, the process for engaging the PMO to complete a security review, requirements for government sponsorship, and how to list products on the Authorized Product List.

stateramp-program-document
StateRAMP PMO Charter

The PMO Charter defines the objectives, roles, and responsibilities associated with the StateRAMP Program Management Office (PMO).

governance
StateRAMP Provider Sponsor Requirements

This document outlines the process (including government sponsorship requirements) for a vendor’s offering to be listed as StateRAMP Authorized on StateRAMP’s Authorized Product List (APL).

provider-document
StateRAMP Security Assessment Framework

This document provides a summary of the objectives, goals, and governance approach of StateRAMP, along with an outlined methodology to verify cloud security.

stateramp-program-document
StateRAMP Security Control Baselines Summary

This document provides a summary of NIST 800-53 Rev. 4 security controls required for verification, by Security Impact Level Category. This summary is the result of ongoing collaboration with State leaders and cybersecurity experts.

stateramp-program-document
StateRAMP Steering Committee Charter

The purpose of this charter is to define the objectives, membership, decision making, meeting schedule, and roles and responsibilities associated with the StateRAMP Steering Committee.

governance
Updated Fee Schedule

This document provides an updated StateRAMP Program Management Fee Schedule, effective January 1, 2023.

stateramp-program-document
Vulnerability Deviation Request Form

When a service provider identifies a vulnerability that potentially warrants different handling than normally required by StateRAMP, they may submit a deviation request to StateRAMP using this form.

continuous-monitoring
Vulnerability Scan Requirements Guide

This guide describes the requirements for all vulnerability scans provided by service providers to StateRAMP for products with a Ready, Provisional, or Authorized status.

continuous-monitoring

Want to learn more about StateRAMP? Click below to watch our latest webinars and briefings in the video library. 

Receive StateRAMP Updates

Interested in StateRAMP? Sign up below to receive StateRAMP Updates.