StateRAMP Authorized Products

StateRAMP establishes common security criteria to standardize cloud security verification.

To manage cyber risk and protect critical data, systems, and infrastructure from cyber-attacks and ransomware, it is recommended that state and local governments verify the cybersecurity posture of their cloud solution providers.

What this means for Service Providers: This standardized approach allows providers serving state and local governments to verify their security posture and prove their cybersecurity compliance to their government clients.

What this means for States and Local Government: StateRAMP’s shared resource model and continuous monitoring simplifies cloud compliance and risk management for government agencies who participate with StateRAMP.

Verified offerings and those in the process of working toward an authorization are listed on the Authorized Product List (APL) below. The APL, published September 14, 2021, is updated weekly.

CompanyProduct NameSecurity StatusService ModelImpact LevelSponsorsReady Date:Authorization Date:3PAO:Point Of Contact:Contact Email:Sponsor Names:Service Description:
BlackBerryBlackBerry Cloud - AtHoc Services for Government (ACSforGov)AuthorizedSaaSModerate12021-12-132022-05-20KratosRashad Munawarrmunawar@blackberry.comStateRAMP Approvals CommitteeBlackBerry’s AtHoc is a networked crisis communication platform enabling corporations and government agencies to communicate and collaborate securely with their personnel and with other organizations through multiple devices during times of crises. BlackBerry’s AtHoc platform addresses critical communications needs including: Account: AtHoc Account enables real-time visibility into location and status for effective personnel accountability and crisis handling before, during, and after emergencies. This integrated approach to personnel accountability enables inputs from managers about their team, call center operators, data streams from HR and travel systems, as well as self-reporting by individuals. Alert: AtHoc Alert provides a comprehensive crisis communication solution that unifies all channels and devices, empowering organizations, people, and communities to collaborate during critical events. AtHoc’s flexible deployment options safeguards important personal information and enables enterprise-level command and control. Connect: AtHoc Connect empowers organizations to create their own permission-based network to establish interoperable communication and information sharing with organizations in their community. Collect: AtHoc Collect empowers your personnel in the field to be the "eyes and ears" of the operations center. AtHoc Collect enables on-scene personnel to report events, work progress, along with rich geo-tagged media that are worth a thousand words.
Continuum GRC, Inc.Continuum GRC ITAMAuthorizedSaaSModerate12022-02-112022-04-26SecuriseaMichael Petersmichael.peters@continuumgrc.comStateRAMP Approvals CommitteeAuto-mapped standards, automated documentation, real-time status, risk & maturity. When it comes to Compliance Cartography, no one is more comprehensive, secure and automated, saving you time, trouble and money. Serving the enterprise to the start-up community. Continuum GRC is a software as a service (SaaS) product that is purpose built for users who perform audit & compliance assessments, risk assessment & risk management, governance & policy development, and all other manner of audits and assessments.

Continuum GRC modules include support for the world’s frameworks, including NIST 800-53. DoD SRG, CMMC, 800-171, 800-66, 800-30, FedRAMP, StateRAMP, CJIS, DFARS, HIPAA, ITRM, AICPA SOC 1, SOC 2, GDPR, ISO 27001, NERC CIP, EUCS, C5, PCI DSS, LADMF and hundreds of others.

In addition to pre-configured questionnaires, assessment modules, and forms, the Continuum GRC ITAM SaaS application has creation tools that provide drag-n-drop easy custom creation for system administrators to construct their own assessment modules in 26 languages. Real time reports on Compliance Status, Risk Scores, Maturity Scores, workflows, tasking records, evidence management, and historical performance helping you stay proactive; not reactive.

Use Continuum GRC to replace existing tools, templates, and manual processes in place to support internal compliance and GRC requirements. The automation of Continuum GRC reduces manual labor, complexity of and between frameworks, produces reports, SSPs, POA&Ms, graphics, dashboards, and related outputs all sustained over the entire lifecycle of the program all within a single view with a unified source for governance, risk and compliance that supercharges performance and eliminates complexity. For a complete list of features and capabilities, please visit https://continuumgrc.com/subscription-options/
Lookout Inc.Lookout Security PlatformAuthorizedSaaSModerate12021-10-262022-01-28Schellman and Company, LLCKimberly Snowkimberly.snow@lookout.comTravis County, TexasLookout Mobile Endpoint Security is an enterprise-grade mobile security solution that provides comprehensive risk management across mobile devices, including iOS and Android, to secure against application, device, and network-based threats while providing visibility and control over data leakage. The Lookout Mobile Endpoint Security suite enables government agencies to secure the organization from mobile threats, identify and control non-compliant mobile apps that pose data leakage risks, and gain visibility into mobile endpoints. Lookout empowers government agencies to adopt secure mobility across personal and GFE devices without compromising productivity.
MicrosoftMicrosoft Dynamics 365AuthorizedSaaSHigh12021-12-152022-04-25KratosJohn Gallagherjogallag@microsoftState of Arizona, Department of Homeland SecurityMicrosoft Dynamics 365 is the next generation of intelligent business applications that enable organizations to grow, evolve, and transform. These applications enable organizations to quickly deliver new purpose-built applications that work seamlessly together to help manage mission-critical functions. Microsoft Dynamics 365 supports more than 90 compliance standards including FedRAMP High.
MicrosoftMicrosoft AzureAuthorizedSaaSHigh12021-12-152022-04-25KratosJohn Gallagherjogallag@microsoft.comState of Arizona, Department of Homeland SecurityMicrosoft Azure is a cloud platform with more than 200 products and cloud services designed to help deliver solutions across different deployment scenarios – Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS). Microsoft Azure supports more than 90 compliance standards including FedRAMP High.
MicrosoftMicrosoft Azure GovernmentAuthorizedSaaSHigh12021-12-152022-04-25KratosJohn Gallagherjogallag@microsoft.comState of Arizona, Department of Homeland SecurityMicrosoft Azure Government is a separate cloud platform to support US federal, state, local, and tribal government agencies. It can support data that’s subject to the CJIS Security Policy and IRS Publication 1075 along with FedRAMP High and other compliance standards. Microsoft Azure Government is delivered through separate datacenters with physical, logical, and network isolation from the commercial cloud and is operated by US persons who have passed fingerprint-based background checks performed by the states.
MicrosoftMicrosoft Dynamics 365 US GovernmentAuthorizedSaaSHigh12021-12-152022-04-25KratosJohn Gallagherjogallag@microsoftState of Arizona, Department of Homeland SecurityMicrosoft Dynamics 365 US Government is the next generation of intelligent business applications that enable US federal, state, local, and tribal government organizations to grow, evolve, and transform. It’s delivered through separate datacenters with physical, logical, and network isolation from the commercial cloud, is operated by US persons who have passed fingerprint-based background checks performed by the states, and can support data that’s subject to the CJIS Security Policy and IRS Publication 1075 along with FedRAMP High and other compliance standards.
SmartronixCloud Assured Managed Services (CAMS)AuthorizedPaaSModerate12021-11-082022-05-20Coalfire SystemsRazaq Ahmedmahmed@smartronix.comStateRAMP Approvals CommitteeThe Smartronix Cloud Assured Managed Services (CAMS) solution gives an organization the ability to leverage the power and scalability of the cloud while reducing the cost and complexity of managing and monitoring cloud solutions in-house. CAMS has been designed to deliver the flexibility customers demand from today’s cloud managed service providers.
TalaTekTalaTek intelligent Governance and Risk Integrated Solution (TiGRIS)AuthorizedSaaSModerate12022-03-032022-04-28Earthling SecurityJohann Dettweilerjdettweiler@talatek.comStateRAMP Approvals CommitteeThe TiGRIS SaaS manages a customer’s information system requirements through the life cycle of its initial security assessment and then throughout the ongoing continuous monitoring of the set of security standards and controls selected by the customer. The TiGRIS application was developed in-house, by TalaTek developers and was designed, by TalaTek, to deliver its Governance, Risk Management and Compliance (GRC) services.
TenableTenable.ioAuthorizedSaaSModerate12022-02-112022-05-09EmagineITInfoSec-Compliancecompliance@tenable.comOwen Zorge, City of Chandler, ArizonaTenable.io is a risk-based vulnerability management platform. Built on an open and elastic platform, it continuously tracks and assess known and unknown assets and their vulnerabilities in your environment to provide a risk-based view of your entire attack surface- from IT to cloud and web applications. Powered by Nessus technology, Tenable.io provides the industry's most comprehensive vulnerability coverage with the ability to understand your cyber risk and predict which vulnerabilities you need to remediate first. Its streamlined and intuitive user experience, gives you immediate insight with intuitive dashboards to quickly deliver value and help your team identify, investigate and prioritize vulnerabilities.
ZscalerZscaler Private Access - Government (Zero Trust Networking - VPN Replacement)AuthorizedSaaSHigh12021-09-102022-03-18Schellman and Company, LLCBradley Josephsbjosephs@zscaler.comState of Arizona Department of Homeland SecurityZscaler Private Access solves the challenges posed by a traditional VPN infrastructure by decoupling your internal assets and applications from the limitations, cost, and complexity of direct IP network connections.
ZscalerZscaler Internet Access - Government (Secure Web Gateway - vTIC)AuthorizedSaaSModerate12021-09-102022-01-28Schellman and Company, LLCBradley Josephsbjosephs@zscaler.comState of Arizona Department of Homeland SecurityZscaler Internet Access delivers your security stack as a service from the cloud, eliminating the cost and complexity of traditional secure web gateway approaches.
Aurigo Software Technologies Inc.Masterworks Cloud and Aurigo EssentialsReadySaaSModerate02021-10-15The Cadence GroupVivek Siddegowdavivek.siddegowda@aurigo.comThe Aurigo Masterworks Cloud is an integrated suite of enterprise software products for owners to plan, build, and maintain large capital assets, infrastructure, and facilities. Aurigo Essentials is an all-in-one product for small to mid-size agencies with easy-to-deploy and industry-ready configurations.
AvayaAvaya OneCloud for GovernmentReadySaaSModerate02021-11-05Coalfire SystemsLodovico Loquerciolloquercio@avaya.comFull UcaaS offering including audio/video conferencing and audio contact center.
BlackBerryBlackBerry ProtectReadySaaSModerate02022-01-10Booz Allen HamiltonRashad Munawarrmunawar@blackberry.comBlackberry PROTECT redefines what antivirus (AV) can and should do for your organization by leveraging artificial intelligence to detect AND prevent malware from executing on your endpoints in real time. By taking a mathematical approach to malware identification utilizing patent-pending, machine learning techniques instead of reactive signatures and sandboxes, Blackberry PROTECT renders new malware, viruses, bots and unknown future variants useless. Blackberry has developed the most accurate, efficient and effective solution for preventing advanced persistent threats and malware from executing on your organization’s endpoints. At the core of Blackberry ’s unprecedented malware identification capability is a revolutionary machine learning research platform that harnesses the power of algorithmic science and artificial intelligence. It analyzes and classifies hundreds of thousands of characteristics per file, breaking them down to an atomic level to discern whether an object is “good” or “bad” in real time. Blackberry OPTICS, part of the prevention-first Blackberry Security Platform, is an artificial intelligence (AI) driven endpoint detection and response (EDR) solution designed to extend the prevention delivered by Blackberry PROTECT through root cause analysis, scalable threat hunting, and automated threat detection and response without increasing costs or security team workloads. Blackberry PROTECT and Blackberry OPTICS are managed through a single web interface within the FedRAMP boundary, and both capabilities are included in the Blackberry PROTECT cloud service offering.
BlackBerryBlackBerry Government Mobility Suite (BGMS)ReadySaaSModerate02021-12-03KratosRashad Munawarrmunawar@blackberry.comBlackBerry Government Mobility Suite (BGMS) is a cloud-based endpoint management solution. BGMS provides customers the ability to utilize a single, integrated view of users, devices, applications, and policies within their IT environment. Customers can use BGMS to unify multi-OS endpoints across all ownership models while securing sensitive data. BGMS is deployed in Microsoft Azure FedRAMP approved Government cloud as a multi-tenant, government-only community cloud deployment model. The BGMS architecture will serve as the baseline infrastructure for BlackBerry FedRAMP authorized productivity applications such as BlackBerry Work and BlackBerry Workspaces; these solutions will provide mobile access to key business tools like email, calendars, contacts, and tasks as well provide secure access to enterprise file repositories.
Box, Inc.Box Enterprise Cloud Content Collaboration PlatformReadySaaS, PaaSModerate02022-05-19Schellman & CompanyBrett Foxbfox@box.comThe Box Enterprise Content Cloud Collaboration Platform enables business to easily share, manage and secure their content. In today’s mobile-first, cloud-first world, providing employees with secure access to content at any time using any device is critical to creating a more productive, connected workforce and improved customer experiences. Beyond secure file sharing, Box enables easy access to content and collaboration tools from any device with the security, scalability and administrative controls that IT requires.
Knowledge ServicesdotStaffReadySaaSModerate02021-09-13A-LignDave Stengerdaves@knowledgeservices.comKnowledge Services dotStaff™ is a Software as a Service (SaaS) offering that includes a Vendor Management System and a Survey Management module.
OCLCWorldShare Management ServicesReadySaaSLow02021-09-29Schellman and Company, LLCAnthony Fisicfisica@oclc.orgOCLC is a nonprofit global library organization. Through OCLC, member libraries cooperatively produce and maintain WorldCat, the world’s most comprehensive global network of data about library collections and services.
OktaOkta IDaaSReadySaaSModerate12021-11-19Schellman and Company, LLCMark Forreidermark.forreider@okta.comState of ArizonaThe Okta IDaaS Regulated package includes a number of components that may be used to provide methods of authentication and provisioning control including Okta core, Okta Mobile, Okta Verify, Okta Directory Agent, and Okta IWA Agent.
Project Hosts, Inc.Project Hosts Federal Private CloudReadyPaaSModerate02021-09-10Coalfire SystemsJoshua Kruegerjosh.krueger@projecthosts.comThe Federal Private Cloud (FPC) is a General Support System (GSS) is composed of systems and services that manage access control, authentication, auditing, monitoring, scanning, patching, configuration management, malware prevention, intrusion prevention, incident response, backup, and disaster recovery for each Application deployed on the FPC.
TTECHumanify EnterpriseReadySaaSModerate02021-10-15Coalfire SystemsKip Jameskip.james@ttec.comThe TTEC Humanify Enterprise - G is an OmniChannel Contact Center as a Service solution that enables routing of Voice, eMail, Chat, Artificial Intelligence, and SMS interactions between citizens and government entities.
WorkdayWorkday Government CloudReadySaaSModerate02021-12-08Coalfire SystemsLeigh Ann Montgomeryleighann.montgomery@workday.comWorkday is a provider of enterprise applications for financial management, human capital management, planning, and analytics. Workday Government Cloud is a multi-tenant public cloud-based offering for U.S. federal, state and local government customers, as well as U.S. government contractors, and Federally Funded Research and Development Centers (FFRDCs). It comprises the following enterprise management cloud applications: Workday Core Financial Management, Projects, Project Billing, Expenses, Procurement, Inventory, Grants Management, Human Capital Management, Cloud Connect for Benefits, Payroll for the United States, Cloud Connect for Third-Party Payroll, Time Tracking, Recruiting, Prism Analytics, and Student. Also available is Workday Success Plans, a subscription-based success package that provides education, tools, and expertise to help agencies maximize their use of Workday.
ZoomZoom for GovernmentReadySaaSModerate02022-02-11Schellman and Company, LLCChristina Gathzfgcompliance@zoom.usThe Zoom For Government Platform unifies cloud video conferencing, cloud phone system, messaging, simple online meetings, and a software-defined conference room solution into one easy-to-use platform. The solution offers video, audio, phone, and wireless screen-sharing across Windows, Mac, Linux, Chrome OS, iOS, Android, Blackberry, Zoom Rooms, and H.323/SIP room systems. Zoom Products include:

Zoom Cloud Video Conferencing – a cloud-based collaboration service which includes video, audio, content sharing webinars and collaboration.
Zoom Phone - a cloud-based phone system with traditional PBX features, integrated PSTN connectivity, enhanced emergency services, and support for calling from mobile apps, desktop apps, and legacy desk phone devices.
Zoom Chat - send chat messages in public or private channels organized by projects, teams, or topics with the ability to share files, emojis, screenshots, and more.
Zoom Rooms – software-based group video conferencing for conference and huddle rooms that run off-the-shelf hardware including a dedicated MAC or PC, camera, and speaker with an iPad controller.
Zoom Room Connector – a gateway allowing H.323 and Session Initiation Protocol (SIP) systems to connect to Zoom meetings. Room Connector is available in both cloud computing and as software (VM) for installation on the customer premise.
Zoom Meeting Connector – a software (VM) version of the Zoom Cloud infrastructure intended for installation on the customer premise.
Zoom API - provides the ability for developers to easily add Video, Voice and Screen Sharing to your application. Our API is a server side implementation designed around REST. The Zoom API helps manage the pre-meeting experience such as creating, editing and deleting resources like users, meetings and webinars.
BlackboardBlackboard Learn SaaSPendingSaaSModerate0A-LignAndrew Keeneyandrew.keeney@blackboard.comBlackboard's Learn SaaS solution offers government and military agencies next-generation online, social and mobile tools that create a continuous learning environment, built around peer-to-peer interaction, content, and discussions
DynatraceDynatrace for GovernmentPendingSaaSModerate0Schellman and Company, LLCRush Modirush.modi@dynatrace.comDynatrace provides software intelligence to simplify cloud complexity and accelerate digital transformation. With automatic and intelligent observability at scale, our all-in-one platform delivers precise answers about the performance and security of applications, the underlying infrastructure, and the experience of all users to enable organizations to innovate faster, collaborate more efficiently, and deliver more value with dramatically less effort.
MicrosoftMicrosoft Office365PendingSaaSHigh0Coalfire SystemsShawn Veneyshawn.veney@microsoft.comState of ArizonaOffice 365 combines the Microsoft Office desktop suite with cloud-based versions of Microsoft's next-generation communications and collaboration services—including Microsoft Exchange Online, Microsoft Teams, and Office for the web. Microsoft Office 365 supports many compliance standards including FedRAMP Moderate.
MicrosoftMicrosoft Office365 Government Community CloudPendingSaaSHigh0Coalfire SystemsShawn Veneyshawn.veney@microsoft.comOffice 365 Government Community Cloud is built for US federal, state, local, and tribal government organizations and combines the Microsoft Office desktop suite with cloud-based versions of Microsoft's next-generation communications and collaboration services—including Microsoft Exchange Online, Microsoft Teams, and Office for the web. Microsoft Office 365 Government Community Cloud can support data that’s subject to the CJIS Security Policy and IRS Publication 1075 along with FedRAMP Moderate and other compliance standards.
ORock Technologies, Inc.ORockCloudPendingIaaSModerate0Schellman and Company, LLCAbigail Halderahalder@orocktech.comThis secure, open source cloud provides a highly scalable, bi-coastal environment with elastic, on-demand access to computing, storage, virtualization, networking, performance monitoring, and applications in ORock’s service catalog.
Quzara, LLCCybertorchPendingSaaS, PaaSHigh0Schellman & Company, LLCSaif Rahmansrahman@quzara.comQuzara Cybertorch™ (Cybertorch) is a Managed Detection and Response (MDR) Platform providing Soc-As-A-Service (SocaaS). The system is intended solely for use by United States Federal, State, Local, and Tribal Governments, Government Consultants, and Federally Funded Research and Development Centers (FFRDC) (referred to throughout the following sections as “customers”) delivered through a Government Community Cloud Deployment Model. Cybertorch delivers Managed Vulnerability Management and Security Monitoring solutions and services. The security monitoring capabilities extend to cloud, datacenters, on-premises, IoT, OT signals converging to a single correlation, aggregation and analysis fusion capability driven and built on Zero trust principles, purpose-built to FedRAMP HIGH and DoD Security Requirements Guide (SRG). These services are delivered through a Platform which leverages components of Software-as-a-Service (SaaS) and Platform-as-a-Service (PaaS) as defined in NIST SP 800-145 (NIST Definition of Cloud Computing. Cybertorch services and security architecture are based on Zero Trust Architecture principles described in NIST SP 200-207 (Zero Trust Architecture) for Enclave-based deployments and Enhanced Identity Government. Further, concepts of control plane and data plane are used throughout the architecture to segregate and isolate customers data.
Building on these security and trust architecture concepts, Cybertorch’ s unified platform allows the delivery and support of full end to end security coverage utilizing in-house security analysts along with Artificial Intelligence engines. Cybertorch provides managed Security Operations Services providing prevention, detection, and remediation services for the Customer. Cybertorch is supported by an enterprise-class cloud computing architecture that is delivered on the Government regions of Azure Infrastructure-as-a-Service (IaaS) platform.
VMwareVMC on AWS GovCloudPendingIaaSHigh0Coalfire SystemsJoe Witlesjwitles@vmware.comVMware Cloud on AWS GovCloud (US) brings VMware’s rich Software-Defined Data Center software to the AWS GovCloud (US) Region, and enables U.S public sector agencies to securely run production applications across VMware vSphere®-based private, public and hybrid cloud environments, with optimized access to AWS services. Jointly engineered by VMware and AWS, this on-demand service enables IT teams to seamlessly extend, migrate and manage their cloud-based resources with familiar VMware tools – without the hassles of learning new skills or utilizing new tools. VMware Cloud on AWS GovCloud (US) integrates VMware’s flagship compute, storage and network virtualization products (VMware vSphere®, VMware vSANTM and VMware NSX®) along with VMware vCenter® management as well as robust disaster protection, and optimizes it to run on dedicated, elastic, Amazon EC2 bare-metal infrastructure that is fully integrated as part of the AWS GovCloud (US). This service is delivered, sold and supported by VMware and its partners. With the same architecture and operational experience on-premises and in the cloud, IT teams can now quickly derive instant business value from use of the AWS and VMware hybrid cloud experience.
VMwareWorkSpace OnePendingSaaSModerate0Coalfire SystemsJoe Witlesjwitles@vmware.comVMware Workspace ONE® is a FedRAMP Moderate Authorized solution, providing a digital workspace platform that combines endpoint device deployment and management with secure Zero Trust Access for agencies & branches.

Consistently ranked as a leader by industry analysts, Workspace ONE delivers consumer-simple, single sign-on (SSO) access to cloud, web, and Windows apps in one unified catalog that engages employees. Agencies can enable employees with a broad range of devices including iOS, Android, Mac, Windows and rugged devices to meets the needs or preferences of a user or their mission while enforcing fine-grained, conditional access policies that also take into account device compliance information delivered by unified endpoint management (UEM) technology.

The Workspace ONE FedRAMP environment now includes ‘Workspace ONE Access’, (formerly VMware Identity Manager), which provides multi-factor and derived credentials authentication, conditional access and single sign-on to SaaS and web apps, and Workspace ONE Intelligent Hub, which offers a unified catalog, actionable notifications of potential interest to employees, and a people directory for a full digital workspace experience.
WellspringSophia Knowledge Management SystemPendingSaaSModerate0LunarlineMatthew Hamiltonmatt.hamilton@wellspring.comWellspring Knowledge Management System (Sophia) is a Software-as-Service (SaaS) solution designed to manage technology transfer operations and knowledge asset tracking for those working in the area of research and innovation. The product services solutions within intellectual property (patent) management, licensing and contract management, invention and ideas disclosure, along research and development (R&D) portfolios and project management.

The data in the system is typically directly entered by users and includes storage of various metadata around invention, patents, projects, contracts, and contacts associated with those records. Users may supplement these with uploaded notes, related files, workflow status, financial information, contract terms and other information that is critical to the tracking of the end users portfolio. Key functional areas of the system are:

idea disclosure from researchers and inventors.
evaluation of inventions and Intellectual property protection
support of patent prosecution and monitoring
tracking contracts and technology licensing terms
financial management of patent expenses and licensing revenue
compliance with contract terms and invention reporting
project and portfolio management
ZibaSecPhishTACOPendingSaaSModerate0Coalfire SystemsJulie Davilaj@zibasec.ioZibaSec PhishTACO is a cloud-based SaaS solution that enables organizations of all sizes to accurately assess their risk levels using sophisticated email phishing campaigns.
AINSeCaseIn ProcessSaaSModerate0FortreumSrinivasSristyAINS’ dynamic case management platform, eCase, is a complete automated information management, tracking, and reporting solution. eCase provides a means of swift but controlled collaboration and oversight between multiple users, simultaneously allowing for increased productivity while decreasing human error. However, for collaboration to be truly dynamic it has to be scalable and without boundaries. eCase can be deployed enterprise-wide so that users from multiple offices and scattered locations can collaborate at whatever respective level of input is required, from an approval signature to a grammar correction. eCase PaaS has multiple modules (applications) like Correspondence, HR, ER/LR, Foiaxpress, PAL. Foiaxpress collaboration, eCase portal ,Audit, Investigation, ARCATS,Workers compensation and Telework.
AvePoint, Inc.AvePoint Online Services for US GovernmentIn ProcessSaaSModerate0LunarlineLauren Darnislauren.darnis@avepoint.comvePoint Online Services for US Government is the industry’s first and only 100 percent Microsoft Azure-based Software-as-a-Service (SaaS) platform for Office 365 MT. Requiring no installation or agents, AvePoint Online Services for US Government provides centralized management, governance, backup, reporting and ECM/records management for your Office 365 MT environments.
BoomiAtomSphereIn ProcessSaaSModerate0Schellman and Company, LLCCameron HassCameron_hass@dell.comBoomi AtomSphere is a cloud-native integration Platform-as-a-Service (iPaaS) technology that lets you connect everyone to everything. The Boomi SaaS AtomSphere Platform solves the needs of our government customers with end-to-end capabilities by integrating applications, systems, and connecting people.
CGICGI US CloudIn ProcessIaaSModerate1A-LignRosemary Millikenrosemary.milliken@cgi.comState of Arizona Department of Homeland SecurityCGI GTO delivers centralized, highly secure and fully managed solutions specifically designed to support state and local government needs.
DataBank HoldingsColocation Managed ServicesIn ProcessIaaSModerate0Secure ITMark Houptmhoupt@databank.comCloudPlus delivers highly availability and secured cloud hosting, which includes monitoring, backups and recovery and 24x7x365 technical support.
GoogleGoogle ServicesIn ProcessIaaS, PaaS, SaaSHigh1Coalfire SystemsRodney Nelsonrodneynelson@google.comArizona Department of Homeland SecurityGoogle Services is comprised of Google’s multi-tenant public cloud Google Cloud Platform and built atop the Google Common Infrastructure. The Google Common Infrastructure powers Google worldwide.
Innovative Discovery, LLCInnovative Discovery Government CloudIn ProcessSaaS, IaaSModerate0LunarlineJamie Neilonjamie.neilon@id-edd.comThe Innovative Discovery Government Cloud (ID Gov-Cloud) is a Software as a Service (SaaS) offering that provides a secure and scalable environment for government legal document services. ID Gov-Cloud provides software services to agencies within a secure, scalable, and compliant cloud environment, offering Relativity Analytics, and iCONECT Analytics inhouse – as well as expert consulting and application to get the most from them. Agencies can leverage the full scope of eDiscovery services within one scalable platform, to include but not limited to: processing, document review, advanced analytics, assisted review, legal hold services, and production.
Keeper Security Inc.Keeper Security Government CloudIn ProcessSaaSModerate0A-LignPatrick Tiquetpatrick@keepersecurity.comKeeper Security Government Cloud (KSGC) transforms the way government organizations protect their operations against password-related data breaches and cyberthreats including ransomware and phishing attacks. KSGC provides IT administrators with visibility, management and control over their organization’s password security, monitoring and reporting. The KSGC cybersecurity platform utilizes a zero-trust framework and zero-knowledge security architecture and integrates with on-premise, cloud and hybrid-cloud environments. KSGC utilizes granular, role-based administrative controls including delegated administration. IT Administrators can enforce critical internal control policies including password complexity, IP white listing, two-factor authentication and Data Loss Prevention (DLP). KSGC’s modern provisioning tools allow organizations to rapidly deploy cybersecurity protection to thousands of users, on all their devices, and can integrate with any identity stack including AD, LDAP, SSO (SAML), SCIM and APIs. The cybersecurity platform includes robust event logging, reporting and auditing capabilities with seamless integration with Security Information and Event Management (SIEM) systems.
McAfee EnterpriseMVISION CloudIn ProcessSaaSHigh0KratosPatrick McEnanypartick_mcenany@mcafee.comMcAfee MVISION Cloud discovers all cloud services in use across an organization’s network. It provides a corresponding readiness rating that allows system and data owners to assess cloud risk. It detects anomalous activity that may be indicative of a security breach or insider threat, enabling the organization to respond immediately to potential incidents. Additionally, McAfee MVISION Cloud enhances privacy controls by applying standards-based encryption or tokenization mechanisms to structured or unstructured data while maintaining searching, sorting, and formatting capabilities. McAfee MVISION Cloud enforces risk-based, inline, or offline compliance policies using notifications, blocking, or selective encryption to prevent the leakage of Personally Identifiable Information (PII) and offers the ability to synchronize policies with existing data loss prevention (DLP) solutions.
McAfee EnterpriseMVISION for EndpointIn ProcessSaaSModerate0KratosPatrick McEnanypatrick_mcenany@mcafee.comMcAfee MVISION for Endpoint is a SaaS offering that is deployed on AWS GovCloud IaaS. The SaaS offering is made up of a suite of solutions developed by McAfee. McAfee MVISION for Endpoint enables customers to centrally manage security for their organization while leveraging real-time monitoring and protection of the environment. Machine learning, artificial intelligence, and behavioral analysis are used to detect and respond to suspicious activity based on comparing observed activity to real-world adversarial attack techniques.
Proofpoint, Inc.Proofpoint Email and Information Protection ServiceIn ProcessSaaSModerate0SchellmanTariq Iqbaltiqbal@proofpoint.comThe Proofpoint Email and Information Protection Service is a powerful cloud email security service that integrates threat protection, virus protection, spam detection, message encryption, data loss prevention (DLP), and digital asset protection technologies into an extensible message management platform. The service is designed to fit easily into existing messaging infrastructure, providing efficient performance, accurate message analysis, and a web-based interface for reporting, configuration, and management tasks.
Proofpoint, Inc.Proofpoint Targeted Attack ProtectionIn ProcessSaaSModerate0SchellmanTariq Iqbaltiqbal@proofpoint.comProofpoint Targeted Attack Protection (TAP) helps detect, mitigate, and block advanced threat that target people through email. It detects both known and new, never-before-seen attacks that use malicious attachments and URLs to install malware on a device or trick users to share their passwords or other sensitive information.
QualysQualys Cloud PlatformIn ProcessSaaSModerate0Coalfire SystemsSamuel Aydlettesaydlette@qualys.comThe Qualys Cloud Platform (QCP) is a multi-tenant shared cloud service environment. Its unique computing power is capable of continuously analyzing and correlating information, to assist IT management with identifying and homing-in on threats and eliminating vulnerabilities.
RelativityRelativityOne GovernmentIn ProcessSaaSModerate0Coalfire SystemsKristal Davykristal.morris@relativity.comRelativityOne Government brings the entire e-discovery process together in one secure and extensible platform, connected to your organization’s most sensitive data—and supported by the community of experts you need to untangle it all. Start and finish e-discovery in one solution with best-in-class security, scale, and performance and extend the functionality of the platform to meet your unique needs by leaning on apps built by our ecosystem of Relativity developer partners or building them yourself. With the latest in advanced searching and analytics, machine learning, and visualizations all built in, RelativityOne Government is your complete platform for organizing data, discovering the truth, and acting on it.
VeracodeVeracode Application Security Scanning PlatformIn ProcessSaaSModerate0Schellman and Company, LLCClaire Baileycbailey@veracode.comVeracode’s unified platform helps Government developers and application security teams assess and improve the security of applications from inception through production. With a combination of automation, process, and speed, Veracode integrates application security into the software lifecycle, effectively eliminating vulnerabilities during the development/deployment chain. This solution is widely used by enterprises to secure web, mobile, legacy, and third-party enterprise applications, with a simpler and more scalable way to help reduce software security risk across software infrastructure.
WingSweptCase Management & Tracking System (CMTS)In ProcessSaaSModerate0LunarlineAllison Lehmanallison.lehman@wingswept.comWingSwept has provided case management solutions to investigators at government agencies for more than a decade. WingSwept converted its Case Management & Tracking System (CMTS) into a Commercial Off-The-Shelf (COTS) service offering in 2010. Built with both security and flexibility in mind, CMTS provides for the secure storage, retrieval, and reporting of case management data for investigative offices at all levels of government. The CMTS design is neither static nor monolithic. Intentionally flexible, CMTS provides government agencies with the ability to establish unique naming conventions, tailor agency-specific workflows, and to support a wide range of other user-preferred configurations. An idle-case tracking function also includes both time and activity-based notifications in order to establish and maintain a seamless agency workflow. As an added layer of security, each CMTS customer operates in a secure environment with data separated by customer. Hosted on Amazon Web Services (AWS), CMTS is a web-based, browser-accessible application that requires no device-specific software for implementation. Highly customizable dashboards, combined with specialized labels and entry fields provide investigators with the ability to compile and display comprehensive case metrics in a simplified, user-friendly format. CMTS can display ad-hoc and pre-defined reports in minutes, drastically reducing processing times and increasing staff efficiency. This flexible design allows agencies to tailor workflows in order to match existing processes and to provide for continuity in ongoing investigations. As a result, CMTS may be readily adapted to serve investigative offices of any size. Many of the CMTS customers leverage our optional Online Intake Service (OIS) which allows customers to host or leverage OIS hosted internet facing forms which can collect case intakes to be later securely picked up by the agency CMTS server for potential ingestion as a case.
Wolters KluwerTeamMate+In ProcessSaaSModerate0Schellman & Company, LLCJennifer EsterheldTeamMate-FedRAMP@wolterskluwer.comThe TeamMate+ FedRAMP platform is a suite of services that provides tooling and functionality to auditors for management and tracking of the entire auditing process. The product suite includes TeamMate+ Audit, TeamMate+ Controls, and TeamMate+ Public Sector. The TeamMate+ FedRAMP suite allows auditors and audit organizations to define, track, and manage the audit process within their own standards. TeamMate+ FedRAMP leverages tooling and software to integrate with various services and resources across many systems, enabling auditors to achieve a holistic view of the organization. Through use of cloud technology and wide tooling integration, TeamMate+ FedRAMP enables organizations to align processes and goals for better strategic and tactical insights. TeamMate+ FedRAMP's environment utilizes higher standards for security and compliance, this system has very well-defined boundaries and controlled data ingress and egress patterns.
ZimperiumZimperium zIPSIn ProcessSaaSModerate0Coalfire SystemsBrian Caldwellbrian.caldwell@zimperium.comZimperium zIPS is an advanced mobile threat defense solution for enterprises, providing persistent, on-device protection to corporate-owned and BYOD devices. Leveraging advanced machine learning, Zimperium zIPS detects both known and unknown threats across the kill chain: device, network, phishing, and app attacks. Once deployed on a mobile device, zIPS begins protecting the device against all primary attack vectors, even when the device is not connected to a network.
Cisco Systems, Inc.ThousandEyesActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comThousandEyes integrates monitoring and visualization of device health, end-to-end network paths and the performance of your internally hosted and cloud applications in one place. Identify critical dependencies in your internal network and monitor how device health impacts application performance.
Cisco Systems, Inc.Cisco Smart LicensingActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comSmart Licensing is a cloud-based, software license management solution that enables you to automate time-consuming, manual licensing tasks. ... Smart Licensing offers you Cisco Smart Software Manager, a centralized portal that enables you to manage all your Cisco software licenses from one centralized website.
Cisco Systems, Inc.Cisco Defense OrchestratorActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Defense Orchestrator is a cloud-based management solution that allows you to manage security policies and device configurations with ease across multiple Cisco and cloud-native security platforms.
Cisco Systems, Inc.Cisco Secure Workload (Tetration)ActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Secure Workload is a hybrid-cloud workload protection platform designed to secure compute instances in both the on-premises data center and the public cloud. These compute instances could be virtual machines, bare-metal servers, or containers. It uses machine learning, behavior analysis, and algorithmic approaches to offer this holistic workload protection strategy.
Cisco Systems, Inc.Cisco SecureXActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco SecureX is the broadest, most integrated security platform that connects the breadth of Cisco's integrated security portfolio and the customer's infrastructure for a consistent experience. It unifies visibility, enables automation, and strengthens your security across network, endpoints, cloud, and applications--all without replacing your current security infrastructure or layering on new technology.
Cisco Systems, Inc.Cisco IntersightActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Intersight is a cloud operations platform that consists of optional, modular capabilities of advanced infrastructure, workload optimization, and Kubernetes services. Cisco Intersight infrastructure services include the deployment, monitoring, management, and support of your physical and virtual infrastructure.
Cisco Systems, Inc.Cisco Secure EndpointActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Secure Endpoint (formerly AMP for Endpoints) offers cloud-delivered endpoint protection plus advanced endpoint detection and response across multi-domain control points.
Cisco Systems, Inc.Cisco Cloud Email SecurityActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco SecureX is a cloud-native, built-in platform that connects Cisco Secure Email to the rest of the Cisco Secure Portfolio as well as 3rd party solutions. The broadest, most integrated platform on the market, SecureX removes bottlenecks that currently hinder convoluted security workflows.
Cisco Systems, Inc.Cisco WebexActiveSaaSModerate0KratosDebbie Bidwelldbidwell@cisco.comCreate and join meetings easily from your computer or mobile device. Invite participants to share content in real time. See who you’re talking to. All in a highly secure environment. This is now reality for government agencies, thanks to Cisco WebEx® Web Conferencing.
Cisco Systems, Inc.Cisco Cloudlock for GovernmentActiveSaaSModerate0KratosClaudio Bellolicbelloli@cisco.comCisco Cloudlock is the cloud-native Cloud Access Security Broker (CASB) that helps accelerate use of the cloud. Cisco Cloudlock secures your cloud users, data, and apps, combating account compromises, data breaches, and cloud app ecosystem risks, while facilitating compliance through a simple, open, and automated API-driven approach.
Cisco Systems, Inc.AppDynamics GovAPMActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comAppDynamics GovAPM is a software-as-a-service (SaaS) application performance monitoring (APM) solution. AppDynamics GovAPM provides end-to-end visibility into the performance of applications.
Cisco Systems, Inc.Webex for GovernmentActiveSaaSModerate0KratosDebbie Bidwelldbidwell@cisco.comCisco Webex for Government is a cloud collaboration service that allows customers to call, meet, and message on any device with a single unified application from Webex.
Cisco Systems, Inc.Cisco Unified Communications Manager Cloud for GovernmentActiveSaaSModerate0KratosDebbie Bidwelldbidwell@cisco.comCisco Hosted Collaboration Solution for Government (HCS-G) is a complete unified communications service from the Cisco cloud. It is built to provide government-level security so that organizations can collaborate with anyone, anywhere, on any device.
Cisco Systems, Inc.Cisco Viptela SD-WANActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco SD-WAN powered by Viptela/IOS XE is a highly secure, cloud-scale architecture that is open, programmable, and scalable. Through the Cisco vManage console, you can quickly establish an SD-WAN overlay fabric. Use it to connect data centers, branches, campuses, and colocation facilities to improve network speed, security, and efficiency.
Cisco Systems, Inc. Webex Contact Center Enterprise for GovernmentActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comWebex® Contact Center Enterprise for Government provides a comprehensive, customizable, highly secure solution to meet the complex needs of the world’s largest contact centers. With readily extensible via open APIs and backed by the security and support benefits only available from a trusted brand like Cisco, Webex® Contact Center Enterprise for Government opens a path to the cloud for even the most business-critical contact centers.
Cisco Systems, Inc.Cisco Managed Services AcceleratorActiveSaaSModerate0KratosClaudio Bellolicbelloli@cisco.comMSX FedRAMP is a multi-tenant SaaS orchestration platform created for Federal agencies, Federal service providers, and Federal service integrators to deliver managed services to market. MSX FedRAMP reduces the time to deploy a cloud service from 18 months to a few weeks by accelerating service creation, orchestration, and integration with external services via vendor APIs as well as supporting zero-touch provisioning.
Cisco Systems, Inc.Cisco Umbrella Secure Internet GatewayActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Umbrella unifies multiple security functions in a single cloud service to secure internet access and control cloud app usage from your network, branch offices, and roaming users. Delivered from the cloud with 100% business uptime, Umbrella integrates secure web gateway, DNS-layer security, cloud-delivered firewall, cloud access security broker (CASB) functionality, and threat intelligence for the most effective protection against threats.
Cisco Systems, Inc.Cisco Secure Cloud Analytics (Stealthwatch Cloud)ActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Secure Cloud Analytics is a cloud-delivered, SaaS-based solution that provides end-to-end visibility, behavioral analysis, and threat detection across your private network, public cloud, and hybrid environments. It uses dynamic entity modeling, based on network telemetry and cloud data sources, to rapidly identify threat activity and indicators of compromise to drastically improve your awareness and overall security posture.
Cisco Systems, Inc.Cisco Nexus DashboardActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Nexus Dashboard brings together unified proactive operations, actionable insights across data center networks, open to any fabric or domain, empowering seamless native and fabric agnostic solutions. It’s a powerful easy to use, easy to scale and easy to monitor data center to help operators open to any fabric and domain, leverage the power of NetOps/AIOps with easy to use consumption models across Cisco ACI and DCNM data center fabrics.
Cisco Systems, Inc.Cisco Umbrella DNSActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Umbrella provides DNS-layer security by enforcing security at the DNS and IP layers, Umbrella blocks requests to malicious and unwanted destinations before a connection is even established — stopping threats over any port or protocol before they reach your network or endpoints.
Cisco Systems, Inc.Cisco MerakiActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco Meraki’s cloud management provides centralized visibility & control over Meraki’s hardware, without the cost and complexity of on-premise based management servers and software, wireless controllers or overlay management systems. Integrated with Meraki’s entire product portfolio, cloud management provides feature rich, scalable, and intuitive centralized management for networks of any size.

Meraki’s access points, switches, SD-WAN/Security, video surveillance cameras, wireless WAN, mobile device management, IoT sensors, and WAN insight products are purpose built for cloud management. Cisco Meraki Cloud Networking Architecture allows you to turn your entire network deployment into one platform. With centralized visibility, you control campus or distributed sites and perform diagnostics remotely, eliminating the need for on-premise troubleshooting. You can also enhance network security measures centrally without having to manually install security patches and definition updates in all your branches.
Cisco Systems, Inc.Cisco CX CloudActiveSaaSModerate0Coalfire SystemsClaudio Bellolicbelloli@cisco.comCisco CX Cloud is a cloud-based Software as a Service (SaaS). With CX Cloud, we help drive speed to value from your investment with Cisco and our technology. We do that by delivering the right information at the right time to help you achieve your desired outcomes faster. CX Cloud is a one-stop destination that combines Cisco expertise and best practices with telemetry, AI/ML-driven insights, use cases, and contextual learning.
Duo SecurityDuo FederalActiveSaaSModerate0Coalfire SystemsMinh Tranmintran2@cisco.comDuo’s Federal Editions can verify the identity of users with secure and easy to use two-factor authentication methods that helps public sector entities satisfy NIST 800-63-3 and 53/63/171 authentication requirements. This complete security solution prevents modern attackers that often target multiple areas - including credential theft and the exploitation of known software vulnerabilities affecting outdated software versions.
FormAssembly, Inc.FormAssembly Gov Cloud (FAGC)ActiveSaaSModerate0A-LIGN Compliance and Security, Inc. dba A-LIGNChad Craglechad@formassembly.comFAGC is a web application developed to help businesses build, design, and manage web forms and surveys. The application is aimed at professionals looking to automate form creation independently and can be used without the help of web developers. FAGC helps organizations in multiple industries quickly create web forms, collect data, and eliminate arduous workflows and manual data entry through smart integrations, all in a secure and compliant manner.
Geographic Solutions, Inc.Virtual OneStop - GUSActiveSaaSModerate0A-LignPaul Toomeyptoomey@geosolinc.comDesigned specifically for the diverse needs of the American Job Center system, VOS Sapphire is a Commercial Off-The-Shelf solution that offers over 50 functional modules and components that can be adapted to meet the exact requirements of any state or local workforce organization. We continuously enhance the system based on technological advances and user feedback to ensure it continues to be the most effective online workforce development solution available on the market today.
Mimecast Ltd.Mimecast Federal GridActiveSaaSModerate0Schellman and Company, LLCHarvey Sealehseale@mimecast.comMimecast Federal Grid is a set of cloud services designed to provide next generation protection against advanced email-borne threats such as but not limited to malicious URLs, malware, impersonation attacks, as well as internally generated threats.
SAP National Security SystemsCommercial Regulated Environment (CRE)ActiveSaaS, PaaSModerate0ForterumPenny Kleinpenny.klein@sapns2.comSAP NS2 Commercial Regulated Environment (CRE) includes a suite of intelligent applications and experience management tools. Our intelligent suite includes applications for managing the operational transactions, HR and people management, analytics, and other innovative capabilities. The applications are integration-ready, include embedded intelligence, and offer a consistent and intuitive user interface.
Secure Code Warrior Inc.Secure Code Warrior Learning PlatformActiveSaaSLow0A-LignDimithri Liyanagedliyanage@securecodewarrior.comSecure Code Warrior Training and Learning Platform - We guide each coder along their own preferred learning pathway, so that security-skilled developers become the everyday superheroes of our connected world. We succeed through a human approach that uncovers the secure developer inside of every coder - helping development teams ship quality code faster, so they can focus on creating amazing, safe software for our world.
SophosSophos Intercept XActiveSaaSModerate0A-LignJohn Stokesjohn.stokes@sophos.comSophos Intercept X is the world’s best endpoint protection. It stops the latest cybersecurity threats with a combination of deep learning AI, anti-ransomware capabilities, exploit prevention and other techniques.
Terida, LLCThe Terida RegTech Framework - CLASsoft™ActiveSaaSModerate1KratosTeri Princetprince@terida.comNorth Carolina Military Business CenterThe Terida RegTech Framework - CLASsoft™ is a cloud-based e-operations (business, government, finance, insurance, legal, health, defence / defense) solutions to receive, manage, track, monitor, analyze, evaluate, resolve and audit registrations, applications, users, communications, claims, cases, files, forms and documents
ZscalerZscaler Internet Access - Government (Secure Web Gateway - vTIC)ActiveSaaSHigh1Schellman and Company, LLCBradley Josephsbjosephs@zscaler.comState of Arizona Department of Homeland SecurityZscaler Internet Access delivers your security stack as a service from the cloud, eliminating the cost and complexity of traditional secure web gateway approaches.

Security Status Categories

Verified Offerings 

To be verified, the provider must meet minimum security requirements and provide an independent audit conducted by a third party assessing organization (3PAO). StateRAMP recognizes three verified statuses, including Ready, Provisional, and Authorized. Ready meets minimum requirements; Provisional exceeds minimum requirements and has a government sponsor; Authorized satisfies all requirements and has a government sponsor. To ensure ongoing security compliance and risk mitigation, providers must comply with continuous monitoring requirements to maintain a verified security status. 

Progressing Offerings 

StateRAMP recognizes offerings in the process of working toward a verified offering. To be listed in progress, the provider must be engaged with a third party assessing organization (3PAO) for an independent audit. The progressing statuses include Active, In Process, and Pending. Active is working toward Ready; In Process is working toward Authorized; Pending has submitted a security package to the Program Management Office (PMO) and is awaiting a determination for a verified status.  

Receive StateRAMP Updates

Interested in StateRAMP? Sign up below to receive StateRAMP Updates.