GovRAMP FAQs: Simplifying Federal Cloud Compliance

For those wanting to learn more about GovRAMP, formally known as StateRAMP, we’ve put together answers to some of the most frequently asked questions we receive as an experienced Third-Party Assessment Organization (3PAO). 

These important points of interest around this framework are divided into the following sections: 

• GovRAMP Basics
• GovRAMP Requirements
• GovRAMP Authorization Boundary Guidance
• How Schellman Can Help

GovRAMP Basics

What is GovRAMP?

GovRAMP is a required program for cloud service providers (CSP) who want to offer cloud services to state, local, tribal, and educational governments and its many departments, bureaus, non-profits, agencies, and organizations. The program was formally known as StateRAMP, but officially rebranded its public-facing name to GovRAMP in February 2025 to better represent its mission and scope.

Though GovRAMP does share some similarities with the FedRAMP program supporting federal cloud security compliance efforts, it features distinct requirements that should be noted by any organization considering the program. 

What does SLED Mean?

SLED stands for State, Local, and Education, referring to government entities and public sector organizations at the state and municipal levels, as well as educational institutions. 

In the context of GovRAMP, SLED organizations represent a major segment of the public sector seeking guidance on secure cloud adoption. They often face different compliance and procurement requirements than federal agencies. 

How Will State Agencies Know My Organization Is GovRAMP Authorized?

GovRAMP, like FedRAMP, has a marketplace that lists CSP organizations who have received an Authorization to Operate (ATO) from a partnering state institution. The GovRAMP marketplace also lists CSPs that are considered GovRAMP authorized through reciprocity with the FedRAMP program. 

The marketplace also lists authorized GovRAMP 3PAOs, like Schellman, who can perform assessments supporting those authorizations. The good news is that designated FedRAMP 3PAOs are likely also GovRAMP 3PAOs. CSPs can use FedRAMP 3PAOs for GovRAMP if the 3PAO is registered with GovRAMP. 

What are the Different GovRAMP Security Statuses?

Organizations can be listed on the GovRAMP Marketplace with a variety of statuses that can all be classified into two categories: 

• In Progress
• Verified

In Progress Statuses

To be listed as in progress, you’ll be listed specifically according to the path you’ve chosen to take: 

Verified Offerings

To be listed as one of the verified statuses, you must meet different thresholds of security requirements and provide the results of an independent audit conducted by a 3PAO that confirms your status: 

GovRAMP Requirements

How Do I Determine My GovRAMP Requirements?

Like FedRAMP requirements, GovRAMP requirements are taken from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5.  

In determining which requirements your organizations must meet, you must first determine your baseline, and that’s based on the data you handle: 

• Low: The ground level that any CSP must meet—requires 153 controls for compliance and generally maps to data or systems that involve publicly available data. 
• Moderate: This baseline requires 319 security controls for compliance and generally maps to data or systems that involve confidential data or of high criticality to the continuity of government. 

If you’re familiar with FedRAMP, you may have noticed the conspicuous absence of a High impact baseline. That’s because, at this time, GovRAMP does not authorize these, as most state agencies fall into the Low or Moderate impact areas. That being said, some CSOs are listed as High impact and those were granted authorization via FedRAMP reciprocity. 

Is Penetration Testing Required for GovRAMP?

Yes, penetration testing is a requirement. And while StateRAMP did release its own penetration testing guidance, it follows the same methodology as that for FedRAMP. 

GovRAMP Authorization Boundary Guidance

When obtaining GovRAMP authorization, many of the headaches occur around the Authorization Boundary and diagrams. 

Thankfully, much of StateRAMP’s Authorization Boundary guidance is the same or seeks the same goals as FedRAMP. Moreover, GovRAMP has defined what’s necessary to depict within the Authorization Boundary Diagrams, Network Diagram, and Data Flow Diagrams, and by and large, it’s the same as FedRAMP—meaning, the same scrutiny used at the FedRAMP level should be used for GovRAMP. 

What Data Types Must Be Included in My GovRAMP Authorization Boundary? 

First and foremost, you must account for—and include within the authorization boundary—any data that is created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for a SLED customer, in any medium or form that passes within your cloud service offering. Some examples include: 

• Mission-based information 
• Financial management information 
• Human Resources data 
• IT management data 
• Citizen/taxpayer information 
• Third-party supplier information 

That being said, SLED data can also be broken down into different categories that may make it easier for you to identify it when preparing for GovRAMP: 

What about Corporate Services and Metadata? 

Though SLED and SLED Metadata in their different subcategories must be included in your Authorization Boundary, data about processes within the authorization boundary or SLED customers that do not contain security-sensitive information and/or information that if compromised could be a threat to the systems supporting the processing and storage of SLED data, SLED metadata or SLED personnel data. 

For example: 

• IT utilization and performance data 
• Project planning information 
• Marketing materials 
• Pricing data 

External systems processing or storing corporate metadata may have active connections to the authorization boundary, but all connections must be examined and the 3PAO must validate the type of information transmitted in the connection during initial authorization and during the annual assessment to ensure the data types do not reflect more sensitive data. 

Again, only those corporate systems and services that do not contain SLED data or metadata may exist outside of the authorization boundary—any that do contain that information must meet the same security requirements that your CSO must meet and be brought into the scope of your assessment. 

How Do I Account for External Services/Interconnections within My GovRAMP Authorization Boundary? 

An interconnection is the use of another information system or cloud system to share data and other resources—that includes external services used to support the system. While GovRAMP encourages CSPs to leverage other GovRAMP service providers—as well as FedRAMP-authorized services—you aren’t required to do so. 

That being said, if you do choose to leverage an external service without a GovRAMP status of Authorized or a FedRAMP authorization, you should know that: 

• You will be limited to obtaining a Provisional GovRAMP authorization. Moreover: 
  • Your leveraged service must undergo the GovRAMP Snapshot process, and you’d be limited to a Provisional status until all external systems and services are GovRAMP authorized. 

Your letter awarding the Provisional status will include a list of controls and/or third-party systems that must be remediated before you can be awarded full authorization. 

• For you to achieve full Authorization, your external services must: 
  • Achieve GovRAMP or FedRAMP authorization; or 
  • You must move the product or service into the authorization boundary; or 
  • You must discontinue the use of the unauthorized service and move to a product with a current GovRAMP or FedRAMP authorization. 

How Do I Depict All This in My Diagrams? 

Luckily, GovRAMP adopted a very similar set of guidelines for Authorization Boundary, Network, and Data Flow. 

How Schellman Can Help

Does Schellman Perform StateRAMP Assessments?

We do, and we’ve gained a lot of experience in these assessments since we performed our first one in 2022. 

If you’ve previously worked with us on your FedRAMP assessment, you can expect essentially the same project scope, engagement length, fees, and type of deliverables—Security Assessment Plan (SAP), Security Assessment Report (SAR), Risk Exposure Table (RET), Penetration Test Report—though GovRAMP does have specific templates for those that we use. 

Does Schellman Perform StateRAMP Consultancy Services?

At this time, we do not offer any consultant services for any compliance initiative. That said, to learn more about our federal assessment services, contact us today.