StateRAMP Low+ Category 2

Why does it matter?

A vendor that reads a solicitation asking for "StateRAMP Low+" or "Category 2" has to translate it. The Security Assessment Framework, version 4.2, names three impact levels, Low, Moderate and High, each tied to the FedRAMP Rev. 5 baseline of the same name, and a product's level follows from the data it handles, not from a label in the bid. Getting that translation right decides which controls a 3PAO tests, which status the buyer will accept and how long the contract can wait for verification.

Key benefits include:

• A defined meaning for Low+

StateRAMP's Spring 2021 overview described Category 2 as FedRAMP Low plus select Moderate controls, between Category 1 (FedRAMP Low) and Category 3 (FedRAMP Moderate).

• A current equivalent

Section 1.5.4 of the Security Assessment Framework lists Low, Moderate and High impact levels based on FedRAMP Rev. 5 baselines; Low is the lowest tier with its own Ready requirements.

• Reuse across governments

Verified products are listed publicly on the Program Participants page, so one review can serve many buyers.

• Independent assurance

Ready, Provisionally Authorized and Authorized need an assessment by a 3PAO recognized by FedRAMP and accredited by A2LA (section 1.4.3).

• Ongoing proof

Verified status is not a one-time letter: continuous monitoring, annual assessment and plan of action and milestones (POA&M) deadlines keep it current.

How does it work?

Section 1.5.4 of the Security Assessment Framework makes the impact level the starting point. The Data Classification Tool, version 2.0 of June 2026, is a companion to the GR-199 worksheet: the provider lists information types from NIST SP 800-60 Volume II, assigns provisional confidentiality, integrity and availability impact levels, may adjust each by one level with a written rationale, and takes the highest of the three as the overall level. Public data uses the General Information type; personally identifiable information uses Personal Identity and Authentication.

The provider then climbs the status ladder in section 1.5. A Security Snapshot scores the top 40 controls chosen from MITRE ATT&CK protection values and lasts 12 months. Core confirms 60 foundational NIST controls validated by the PMO. Ready adds a Readiness Assessment Report from a 3PAO against the Minimum Mandatory Requirements, which have a separate version for Low impact. Authorized needs a System Security Plan, boundary diagram, Security Assessment Report and approval from a sponsoring government or the Approvals Committee.

After a status is awarded, section 1.7 applies. Providers scan for vulnerabilities at least monthly, send a monthly executive summary and POA&M update, and have a 3PAO assess roughly one third of the controls each year. GovRAMP's FAQ sets POA&M remediation at 30 days for high-risk items, 90 for moderate and 180 for low. A product with FedRAMP Ready, ATO or P-ATO status can use Fast Track and submit the same audit and package without a new assessment (section 1.8).

Key Elements

• Impact levels (section 1.5.4)

Low, Moderate and High, aligned with the FedRAMP Rev. 5 baselines; the Federal Overlay (version 1.0, adopted April 21, 2026) lists where GovRAMP parameters differ from FedRAMP.

• Data Classification Tool and GR-199

Four-step method built on NIST SP 800-60 Volume II data types; the overall level is the highest of confidentiality, integrity and availability.

• Verified statuses (section 1.5)

Core, Ready, Provisionally Authorized and Authorized, each listed on the Authorized Product List.

• Progressing statuses (section 1.5.10)

Progressing, Not Progressing, In Process (up to six months, one 30-day extension) and Pending, shown on the Progressing Product List.

• Governance

A Board of Directors with a majority of government members, an Approvals Committee that acts as sponsoring body, a Standards & Technical Committee and the PMO.

• Continuous monitoring (section 1.7)

Monthly scans and summaries, annual 3PAO assessment of about one third of controls, an escalation process and revocation of a status for non-compliance.

What does it cover?

The framework covers cloud products, meaning IaaS, PaaS and SaaS, that process, store or transmit the data of state, local, tribal and territorial governments, public higher education and private K-12 and higher education institutions, which the Board added as public sector stakeholders in 2023. Each product is assessed on its own boundary at the impact level the data requires, and a SaaS product on an authorized infrastructure does not inherit authorization, though it may inherit applicable controls. The Low+ label itself is not an assessable status in version 4.2.

What are its objectives?

The framework states its purpose in section 1.5: reduce barriers and cost for providers while reflecting the different risk levels public sector organizations face.

Verify the security of cloud products with a common, third-party method built on NIST SP 800-53 Rev. 5.

Let a provider start with a Snapshot, Core or Ready status and progress toward Authorized.

Give governments a public list of verified and progressing products.

Keep verified products secure through continuous monitoring and escalation.

Promote reciprocity so that one verification serves many governments.

Framework in Context

GovRAMP is modeled on FedRAMP, and its Low, Moderate and High levels follow the FedRAMP Rev. 5 baselines, so a FedRAMP Ready, ATO or P-ATO product can use Fast Track. Texas DIR's TX-RAMP Program Manual, version 3.1, grants Level 2 certification to GovRAMP Core, Ready, Provisionally Authorized and Authorized products. Moderate and High data sit one step up: see StateRAMP Moderate (Category 3) and the program overview on the GovRAMP page. GovRAMP's 2025 rebrand did not change the legal entity, its contracts or its memberships.

Common Framework Mappings

Organizations map GovRAMP controls to the frameworks below so that one set of controls and evidence serves GovRAMP, FedRAMP and other cloud security reviews.

Mapped frameworks include:

CIS Controls v8.1

CSA CCM v4

FedRAMP Rev. 5

ISO 27001:2022

ISO 27002:2022

ISO 27017

NIST CSF 2.0

SOC 2