StateRAMP Moderate Category 3

Why does it matter?

Agencies and school systems entrust software with personal identity records, health information, payment data and criminal justice information, and the GovRAMP Data Classification Tool rates each data type before a product's level is set. A provider without a verified status at the level a solicitation names can be shut out of it, or forced into a long wait while it assembles a package. The framework gives it a staged path: a Core status first, then Ready, then Authorized.

Key benefits include:

• The FedRAMP Rev. 5 Moderate baseline

Section 1.5.4 of the Security Assessment Framework defines Moderate as aligned with Moderate impact, based on the FedRAMP Rev. 5 Moderate control baseline.

• A fast first step

GovRAMP Core confirms 60 foundational NIST controls aligned with the Moderate baseline and is validated by the PMO rather than a 3PAO.

• Reuse across states

A verified product is listed publicly, and Texas treats Core, Ready, Provisionally Authorized and Authorized as TX-RAMP Level 2.

• Fast Track from FedRAMP

Products with FedRAMP Ready, ATO or P-ATO status submit the same audit and package without a new assessment (section 1.8).

• A CJIS option

GovRAMP publishes a Moderate package with a CJIS overlay for providers whose data includes criminal justice information.

How does it work?

Impact level comes first. The Data Classification Tool, version 2.0 of June 2026, tells a provider to pick NIST SP 800-60 Volume II data types, assign confidentiality, integrity and availability ratings, adjust by no more than one level and take the highest rating. It notes that the IRS categorizes federal tax information as moderate risk, and that governments may add state-specific CJIS controls to Moderate. The GR-199 worksheet records the result for the 3PAO and the PMO.

For Moderate, the provider moves through section 1.5. Core is a PMO-assessed set of 60 controls with quarterly continuous monitoring and 12-month validity. Ready requires a Readiness Assessment Report from a 3PAO, the boundary diagram, inventory worksheet and roles and permissions matrix, measured against the Ready Minimum Mandatory Requirements for Moderate and High impact (version 3.0, adopted October 30, 2023). Authorized requires the System Security Plan, a Security Assessment Report covering the required controls, penetration testing and approval by a sponsoring government or the Approvals Committee.

A product with deficiencies that can be fixed through a plan of action and milestones (POA&M), or that depends on an interconnected technology that is not yet authorized, may receive Provisionally Authorized status (section 1.5.6). Monitoring then runs monthly: vulnerability scans, an executive summary and POA&M update, and each year a 3PAO assesses roughly one third of the controls. GovRAMP's FAQ sets remediation at 30 days for high-risk items, 90 for moderate and 180 for low.

Key Elements

• Moderate impact level (section 1.5.4)

The FedRAMP Rev. 5 Moderate baseline, with the Federal Overlay (version 1.0, adopted April 21, 2026) listing where GovRAMP parameters differ from FedRAMP.

• Core status (section 1.5.3)

Baseline NIST 800-53 Rev. 5 controls and documentation validated by the PMO, with quarterly evidence and Web App, Vulnerability and Policy Compliance scans.

• Ready status (section 1.5.5)

A 3PAO readiness report against the Minimum Mandatory Requirements for Moderate and High impact.

• Provisionally Authorized and Authorized (sections 1.5.6 and 1.5.7)

Full security package: System Security Plan, boundary diagram, Security Assessment Report and POA&M, approved by a sponsoring government or the Approvals Committee.

• Controls Matrix

GovRAMP's document library links the Moderate Rev. 5 Controls Matrix, version 1.06, next to the System Security Plan template.

• Continuous monitoring (section 1.7)

Monthly scans and summaries, an escalation process and revocation of a status for non-compliance.

What does it cover?

The framework covers IaaS, PaaS and SaaS products that process, store or transmit the data of state, local, tribal and territorial governments, public higher education and private K-12 and higher education institutions. Each product is assessed within its own authorization boundary, and a SaaS product that runs on an authorized infrastructure does not become authorized by that fact, although it may inherit controls. Data that needs the High impact level, or that carries restrictions on foreign nationals or access location, falls outside this page.

What are its objectives?

GovRAMP's stated goals in section 1.5 and its background section are a common method for verifying cloud security and a lower cost of compliance for providers.

Verify cloud products against the FedRAMP Rev. 5 Moderate baseline through independent 3PAO assessment.

Offer a path from Snapshot and Core to Ready and Authorized for providers of every size.

Give governments one public list of verified products and their statuses.

Maintain assurance with continuous monitoring, annual reauthorization and escalation.

Allow one verification to serve many participating governments.

Framework in Context

GovRAMP is modeled on FedRAMP, so a FedRAMP Moderate product can use Fast Track, and the framework's controls come from NIST SP 800-53 Rev. 5, which all providers had to meet by October 1, 2024. TX-RAMP Level 2 accepts GovRAMP statuses through DIR's Program Manual, version 3.1. The lighter tier is covered on StateRAMP Low+ (Category 2), and the legal entity, rebrand and governance are described on the GovRAMP page. Moderate is distinct from the High level, whose providers may face extra residency and access restrictions.

Common Framework Mappings

Organizations map GovRAMP Moderate controls to the frameworks below so that one set of controls and evidence serves GovRAMP, FedRAMP and other cloud reviews.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Rev.5 Moderate

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2