GovRAMP compliance
GovRAMP is how a growing number of state and local governments verify the security of the cloud products they buy. We prepare providers for every GovRAMP status, from a first Security Snapshot through Authorized, and build the evidence so it holds up at each quarterly review, not only on assessment day.
Where the program stands
Five statuses. GovRAMP verifies providers at Progressing Snapshot, Core, Ready, Provisional and Authorized, at Low, Moderate or High impact. Ready and above require a third-party assessment organization (3PAO). Core does not: the GovRAMP Program Management Office assesses it directly against 60 controls, and Core status carries quarterly continuous monitoring.
The Snapshot is no longer a parking spot. Since 1 January 2026, a product needs a non-zero Snapshot score to be listed, has to show improvement at every quarterly Snapshot, and can be removed from the Progressing Product List if it stalls. A perfect score does not end the obligation; providers are expected to move on to a verified status.
High impact. GovRAMP published High impact templates in March 2026 and has authorized products at that level.
GovRAMP and FedRAMP 20x
Under FedRAMP's Consolidated Rules for 2026, a GovRAMP assessment at any impact level, completed within the past 12 months, satisfies the approved alternative security framework prerequisite for a FedRAMP 20x Class A certification (rule FRC-CLA-ASF). For a provider selling to both state and federal buyers, a current GovRAMP assessment is now a route into the federal market rather than a separate project.
The rule does not say which GovRAMP statuses qualify. It lists a GovRAMP Readiness Assessment Report and Security Assessment Plan among the materials to submit, which points to a 3PAO-assessed status rather than Core, but it does not state that outright. We confirm the point for your status before any plan depends on it.
What we do
- Status planning. We work out which status your state and local contracts actually require, and the shortest credible route to it.
- Core. We build the evidence package for the 60 Core controls, including the policies and procedures the PMO reviews, and draw as much of the evidence as possible directly from your systems.
- Progressing Snapshot. We raise your score quarter over quarter with evidence your systems produce, so each Snapshot shows the improvement GovRAMP now requires.
- Ready and Authorized. We write the system security plan from your running environment and prepare you for the 3PAO assessment. We have conducted these assessments as a 3PAO, and we build packages with that review in mind.
- Continuous monitoring. We set up quarterly monitoring deliverables that are generated from your systems rather than assembled by hand each quarter.
- State and federal together. If you also sell to federal agencies, we plan one evidence base that serves GovRAMP and FedRAMP 20x.
Why our approach is different
GovRAMP increasingly measures providers every quarter, not once. A program built from documents has to be rebuilt every quarter; a program built from system configuration reports its own state. We treat compliance as a property of the system itself, verified from its real configuration. We call this Compliance as Infrastructure™.