The Schellman Blog

GovRAMP (formerly StateRAMP) continues to provide useful avenues for Cloud Service Providers (CSPs) to build secure products for use by State agencies. Earlier this year, GovRAMP released a modified high baseline for CSPs to leverage in protecting the most sensitive SLED data processed by agencies.

If your organization sells cloud-based solutions to state and local police departments, courts, or other criminal justice agencies, you're already familiar with the expectation that Criminal Justice Information Services (CJIS) compliance is essential.

Any Cloud Service Provider (CSP) who is familiar with FedRAMP likely knows that presenting an authorization package that includes a non-FedRAMP-authorized external service storing or processing of federal metadata wouldn’t get you very far—it’s likely a showstopper. However, some may not realize that that’s not necessarily the case regarding StateRAMP.

When organizations opt to pursue a new compliance initiative, aside from cost and necessary resources, the first thought is usually regarding what to expect. That’s true for StateRAMP as well, and though many may—correctly—assume that there are some similarities between it and the more popular FedRAMP, there are several very clear deviations by the former from the latter that you know about going in.

For those wanting to learn more about GovRAMP, formally known as StateRAMP, we’ve put together answers to some of the most frequently asked questions we receive as an experienced Third-Party Assessment Organization (3PAO).

Everyone has likely heard of FedRAMP by this point, but when preparing an initial cloud service offering (CSO) for use by the DoD, you must implement controls above and beyond those baselines, including NIST SP 800-53 controls, Non-NIST based DoD requirements, and DoD General Readiness requirements.