StateRAMP
The state-government analog to FedRAMP — a standardized cloud security verification program so US state and local governments can reuse a single security assessment instead of each running its own.
StateRAMP was created because FedRAMP only covers federal agencies — state and local governments had no equivalent standardized process, so cloud providers faced a patchwork of different state requirements. StateRAMP uses security categorization and control baselines modeled closely on NIST SP 800-53, the same control family FedRAMP is built on, which makes a StateRAMP authorization a natural complement to (and in some cases a stepping stone toward) FedRAMP.
Providers progress through StateRAMP's status levels — beginning with "StateRAMP Ready" (a readiness assessment) and progressing to "StateRAMP Authorized" (a full, verified authorization) — which state and local government customers can rely on directly rather than commissioning their own assessment.
Who is impacted
Cloud service providers selling to US state and local governments, and the government entities themselves that want a standardized way to verify a cloud vendor's security posture without running a bespoke assessment for every vendor.
Requirements
A security package built around NIST SP 800-53-aligned controls, scoped to Low, Moderate, or High impact; an independent, StateRAMP-recognized third-party assessment; and continuous monitoring obligations once authorized — structurally close enough to FedRAMP that providers pursuing both programs can reuse significant documentation between them.
Executive guides & research
StateRAMP: The Complete Executive Guide
The state and local government equivalent of FedRAMP — how it works, and how an existing FedRAMP authorization streamlines the path to StateRAMP status.
Glossary
StateRAMP Authorized
The status a cloud provider reaches after completing a full, independently verified StateRAMP security assessment — the program's highest, most reusable status for state and local government customers.
Related regulations
Related
Stay ahead of StateRAMP changes
Get Regulatory Alerts the moment something about StateRAMP changes — new deadlines, guidance updates, enforcement actions.