GovRAMP

Why does it matter?

Governments cannot audit every cloud provider on their own. GovRAMP gives participating governments one verification, one product list and one continuous monitoring record to rely on, and gives providers one assessment to reuse instead of answering a separate security questionnaire for each buyer.

Key benefits include:

• A defined path from first snapshot to full authorization

Providers can begin with a Security Snapshot of 40 controls, enroll in the Progressing Security Snapshot Program, and advance to Core, Ready, Provisionally Authorized or Authorized status (Security Assessment Framework, section 1.5).

• Recognition across governments

Verified products are listed on the Authorized Product List, so one government's review can be recognized by other state and local governments (sections 1.4.3 and 1.5.11).

• Reuse of federal work

Fast Track requires no new audit for products with a FedRAMP Ready, Authority to Operate or Provisional Authority to Operate status (section 1.8.1).

• Assurance that continues after approval

Providers submit monthly vulnerability scans and plan of action updates, and the PMO and the government can revoke a status through the escalation process (sections 1.7.1 to 1.7.5).

• Controls scaled to the data

Low, Moderate and High impact levels align with the FedRAMP Rev. 5 baselines, and the Data Classification Tool helps choose the right one (section 1.5.4).

How does it work?

GovRAMP uses a step-by-step pathway. A Security Snapshot is a PMO-validated assessment of the top 40 controls, valid for 12 months. Core verifies 60 prioritized controls through the PMO with quarterly continuous monitoring and no 3PAO. Ready adds a 3PAO Readiness Assessment Report (RAR) against minimum mandatory requirements. Authorized requires a full 3PAO Security Assessment Report (SAR) (sections 1.5.1 to 1.5.7).

For Ready and Authorized, the provider submits a System Security Plan (SSP) and a Plan of Action and Milestones (POA&M), and the 3PAO submits a Security Assessment Plan and the RAR or SAR (section 1.5.9). The PMO reviews the package. For Authorized status it sends an executive summary and recommendation to the sponsoring body, a government sponsor or the Approvals Committee, which gives the final approval (sections 1.2.6 and 1.5.7).

Verified status lasts 12 months and is kept through continuous monitoring: vulnerability scans at least monthly, a monthly executive summary and POA&M update, and an annual 3PAO assessment of roughly one third of the controls. Incident response plans are part of the package, and failing to report incidents can trigger a review of the authorization (sections 1.7.1 to 1.7.3).

Key Elements

• Verified statuses

Core, Ready, Provisionally Authorized and Authorized are the four verified statuses. Provisionally Authorized applies when a package meets the Authorized requirements but an interconnected technology has no GovRAMP or FedRAMP status or a deficiency remains (section 1.5.6).

• Impact levels and overlays

Low, Moderate and High impact levels follow the FedRAMP Rev. 5 baselines. The Federal Overlay aligns them with FedRAMP, and the CJIS-Aligned Overlay aligns GovRAMP controls with CJIS Policy 6.0.

• Security package

The package holds the SSP, boundary diagram, inventory worksheet, roles and permissions matrix, 3PAO reports and POA&M, built on GovRAMP templates (sections 1.5.5 and 1.5.9).

• Independent assessment

GovRAMP requires 3PAOs accredited through the FedRAMP 3PAO program, with accreditation through A2LA. The PMO assesses Core and Snapshot submissions itself (sections 1.3.3 and 1.4.3).

• Product lists

The Authorized Product List shows Core, Ready, Provisionally Authorized and Authorized products. The Progressing Product List shows Progressing, Not Progressing, In Process and Pending products (sections 1.5.10 and 1.5.11).

• Governance

A Board with a majority of government members adopts standards. The Standards and Technical Committee advises it, the Appeals Committee hears disputes about PMO decisions, and the Approvals Committee acts as sponsoring body (section 1.2).

What does it cover?

GovRAMP covers cloud products that process, transmit or store a participating organization's data or could affect its data security: Infrastructure as a Service, Platform as a Service, Software as a Service and Security as a Service. The public sector side includes state and local governments, K-12 and public higher education, special districts, emergency medical services, critical infrastructure and nonprofits, with private schools and colleges added in 2023 (section 1.1).

What are its objectives?

GovRAMP aims to give governments a common, low-cost way to verify cloud security.

Verify the security of cloud products against NIST SP 800-53 Rev. 5 controls for the chosen impact level.

Give providers a path that starts with a Snapshot and reaches full authorization over time.

Reduce duplicate assessments by recognizing FedRAMP work and sharing results across governments.

Keep security current through continuous monitoring, escalation and revocation.

Give governments sponsorship and approval roles through government sponsors and the Approvals Committee.

Framework in Context

GovRAMP was modeled on FedRAMP, the federal program for cloud security assessment, and uses the same NIST SP 800-53 Rev. 5 foundation. Rev. 5 replaced Rev. 4, with all providers given until October 1, 2024 to update their packages (section 1.4). Each participating government sets its own adoption rules, listed on the Participating Government Organizations page at govramp.org.

Common Framework Mappings

Organizations commonly map GovRAMP to other standards to align cloud security controls, simplify authorizations and audits, and reuse evidence for cross-framework compliance and continuous monitoring.

Mapped frameworks include:

CSA CCM v4

CIS Controls v8.1

FedRAMP Rev. 5

ISO 27001:2022

ISO 27017

ISO 27018

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2