For those wanting to acquaint themselves with StateRAMP, we’ve put together answers to some of the most frequently asked questions we receive as an experienced Third-Party Assessment Organization (3PAO).
These important points of interest regarding this framework are divided into the following sections:
- StateRAMP Basics
- StateRAMP Requirements
- StateRAMP Authorization Boundary Guidance
- How Schellman Can Help
StateRAMP Basics
What is StateRAMP?
StateRAMP is a required program for cloud service providers (CSP) that want to offer cloud services to the state government and its many departments, bureaus, non-profits, agencies, and organizations.
Though StateRAMP does share some similarities with the FedRAMP program supporting federal cloud security compliance efforts, it does feature some specific particulars that should be noted by any organization considering the program.
What does SLED Mean?
A term that StateRAMP uses often, SLED means “State, Local or EDucation” (Institution).
How Will State Agencies Know My Organization Is StateRAMP Authorized?
StateRAMP, like FedRAMP, has a marketplace that lists CSP organizations that have received an Authorization to Operate (ATO) from a partnering state institution. The StateRAMP marketplace also lists CSPs which are considered StateRAMP authorized through reciprocity with the FedRAMP program.
The marketplace also lists authorized StateRAMP 3PAOs, like Schellman, that can perform assessments supporting those authorizations. The good news is that designated FedRAMP 3PAOs are likely also StateRAMP 3PAOs. CSPs can use FedRAMP 3PAOs for StateRAMP if the 3PAO is registered with StateRAMP.
What are the Different StateRAMP Security Statuses?
Organizations can be listed on the StateRAMP Marketplace with a variety of statuses that can all be classified into two categories:
- In Progress
- Verified
“In Progress” Statuses
To be listed in progress, you’ll be listed specifically according to the path you’ve chosen to take:
|
For those who first pursue a Security Snapshot, you can be listed as: |
|
|
For those pursuing Authorization: |
|
“Verified” Offerings
To be listed as one of the verified statuses, you must meet different thresholds of security requirements and provide the results of an independent audit conducted by a 3PAO that confirms such:
|
Verified Status |
Details |
|---|---|
|
Ready |
What it Means: Your cloud service offering (CSO) meets or exceeds minimum requirements, i.e., Readiness Assessment Report (RAR) approved. Next Steps: You must still undergo additional security and system validation. (NOTE: When you become StateRAMP Ready, unlike with FedRAMP Ready, your RAR doesn’t expire after one year.) |
|
Provisional |
What It Means: Your CSO exceeds minimum requirements—more specifically, you’ve submitted a security package for consideration and your CSO has been found to meet most but not all security requirements. * To achieve a Provisional status, any interconnected technology or external services must have a current StateRAMP Security Snapshot, per the StateRAMP Authorization Boundary Guidance. Next Steps: If you achieve Provisional status, you must comply with continuous monitoring requirements and submit further documentation to obtain Authorized status. |
|
Authorized |
What it means: Your organization has completed all security and system validation, the government has accepted your completed security package, your CSO satisfies all requirements, and it has a government sponsor. Next Steps: You can move forward with providing your CSO to agency sponsors, though you must also maintain compliance with continuous monitoring requirements. |
StateRAMP Requirements
How Do I Determine My StateRAMP Requirements?
Like FedRAMP requirements, StateRAMP requirements are taken from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4. (While Revision 5 has been published, StateRAMP is still currently in the process of transitioning to leveraging it; however, any packages submitted after October 1, 2024, will be required to leverage NIST SP 800-53 Revision 5.)
In determining those your organizations must meet, you must first determine your baseline, and that’s based on the data you handle:
- Low: The ground level that any CSP must meet—requires 153 (at Rev 5) controls for compliance and generally maps to data or systems that involve publicly available data.
- Moderate: This baseline requires 319 (at Rev 5) security controls for compliance and generally maps to data or systems that involve confidential data or of high criticality to the continuity of government.
If you’re familiar with FedRAMP, you may have noticed the conspicuous absence of a High impact baseline. That’s because—at this time—StateRAMP does not authorize these, as most state agencies fall into the Low or Moderate impact areas. That being said, some CSOs are listed as High impact and those were granted authorization via FedRAMP reciprocity.
Is Penetration Testing Required for StateRAMP?
Yes. And while StateRAMP did release its own penetration testing guidance, it’s the same methodology as that for FedRAMP.
StateRAMP Authorization Boundary Guidance
When obtaining StateRAMP authorization, many of the headaches occur around the Authorization Boundary and diagrams.
Thankfully, much of StateRAMP’s Authorization Boundary guidance is the same or seeks the same goals as FedRAMP. Moreover, StateRAMP has defined what’s necessary to depict within the Authorization Boundary Diagrams, Network Diagram, and Data Flow Diagrams, and by and large, it’s the same as FedRAMP—meaning, the same scrutiny used at the FedRAMP level should be used for StateRAMP.
What Data Types Must Be Included in My StateRAMP Authorization Boundary?
First and foremost, you must account for—and include within the authorization boundary—any data that is created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for a State, Local, or Education Institution (SLED) customer, in any medium or form that passes within your cloud service offering. Some examples include:
- Mission-based information
- Financial management information
- Human Resources data
- IT management data
- Citizen/taxpayer information
- Third-party supplier information
That being said, SLED data can also be broken down into different categories that may make it easier for you to identify it when preparing for StateRAMP:
|
Data Type |
Details |
|---|---|
|
SLED Metadata |
Data that, if compromised, could impact the confidentiality, availability, or integrity of the systems supporting the processing, storage, or transmission of SLED data. A few examples:
|
|
SLED Metadata Subcategories |
|
|
SLED Metadata with a Direct Potential Impact on the Mission of Organizations or Individuals
|
This type of SLED customer metadata must reside within your authorization boundary or the boundary of another StateRAMP-authorized information system at the same or greater Impact Level. Some examples:
|
|
SLED Metadata with an Indirect Potential Impact on the Mission of Organizations or Individuals
|
This type of SLED customer metadata may be authorized to reside in a system that is fully owned, maintained, and operated by you with approval from the StateRAMP PMO. Some examples:
|
What about Corporate Services and Metadata?
Though SLED and SLED Metadata in their different subcategories must be included in your Authorization Boundary, data about processes within the authorization boundary or SLED customers that do not contain security-sensitive information and/or information that if compromised could be a threat to the systems supporting the processing and storage of SLED data, SLED metadata or SLED personnel data.
For example:
- IT utilization and performance data
- Project planning information
- Marketing materials
- Pricing data
External systems processing or storing corporate metadata may have active connections to the authorization boundary, but all connections must be examined and the 3PAO must validate the type of information transmitted in the connection during initial authorization and during the annual assessment to ensure the data types do not reflect more sensitive data.
Again, only those corporate systems and services that do not contain SLED data or metadata may exist outside of the authorization boundary—any that do contain that information must meet the same security requirements that your CSO must meet and be brought into the scope of your assessment.
How Do I Account for External Services/Interconnections within My StateRAMP Authorization Boundary?
An interconnection is the use of another information system or cloud system to share data and other resources—that includes external services used to support the system. While StateRAMP encourages CSPs to leverage other StateRAMP service providers—as well as FedRAMP-authorized services—you aren’t forced to do so.
That being said, if you do choose to leverage an external service without a StateRAMP status of Authorized or a FedRAMP authorization, you should know that:
- You will be limited to obtaining a Provisional StateRAMP authorization. Moreover:
- Your leveraged service must undergo the StateRAMP Snapshot process and you’d be limited to a Provisional status until all external systems and services are StateRAMP authorized.
(Your letter awarding the Provisional status will include a list of controls and/or third-party systems that must be remediated before you can be awarded full authorization.)
- For you to achieve full Authorization, your external services must:
- Achieve StateRAMP or FedRAMP authorization; or
- You must move the product or service into the authorization boundary; or
- You must discontinue the use of the unauthorized service and move to a product with a current StateRAMP or FedRAMP authorization.
How Do I Depict All This in My Diagrams?
Luckily, StateRAMP adopted a very similar set of guidelines for Authorization Boundary, Network, and Data Flow, and you can find all the particulars here.
How Schellman Can Help
Does Schellman Perform StateRAMP Assessments?
We do, and we’ve gained a lot of experience in these assessments since we performed our first one in 2022.
If you’ve previously worked with us on your FedRAMP assessment, you can expect essentially the same project scope, engagement length, fees, and type of deliverables—Security Assessment Plan (SAP), Security Assessment Report (SAR), Risk Exposure Table (RET), Penetration Test Report—though StateRAMP does have specific templates for those that we use.
Does Schellman Perform StateRAMP Consultancy Services?
At this time, we do not offer any consultant services for any compliance initiative.
About Jon Coffelt
Jon Coffelt is a Manager with Schellman. Prior to joining Schellman in 2017, Jon worked as a Program Manager, specializing in Information Security. As a Manager with Schellman, Jon is focused primarily on client engagement, project management, assessment, and assurance for commercial organizations across various industries.