StateRAMP FAQ

For those wanting to acquaint themselves with StateRAMP, we’ve put together answers to some of the most frequently asked questions we receive as an experienced Third-Party Assessment Organization (3PAO).

These important points of interest regarding this framework are divided into the following sections:

• StateRAMP Basics
• StateRAMP Requirements
• StateRAMP Authorization Boundary Guidance
• How Schellman Can Help

StateRAMP Basics

What is StateRAMP?

StateRAMP is a required program for cloud service providers (CSP) that want to offer cloud services to the state government and its many departments, bureaus, non-profits, agencies, and organizations.

Though StateRAMP does share some similarities with the FedRAMP program supporting federal cloud security compliance efforts, it does feature some specific particulars that should be noted by any organization considering the program.

What does SLED Mean?

A term that StateRAMP uses often, SLED means “State, Local or EDucation” (Institution).

How Will State Agencies Know My Organization Is StateRAMP Authorized?

StateRAMP, like FedRAMP, has a marketplace that lists CSP organizations that have received an Authorization to Operate (ATO) from a partnering state institution. The StateRAMP marketplace also lists CSPs which are considered StateRAMP authorized through reciprocity with the FedRAMP program.

The marketplace also lists authorized StateRAMP 3PAOs, like Schellman, that can perform assessments supporting those authorizations. The good news is that designated FedRAMP 3PAOs are likely also StateRAMP 3PAOs. CSPs can use FedRAMP 3PAOs for StateRAMP if the 3PAO is registered with StateRAMP.

What are the Different StateRAMP Security Statuses?

Organizations can be listed on the StateRAMP Marketplace with a variety of statuses that can all be classified into two categories:

• In Progress
• Verified

“In Progress” Statuses

To be listed in progress, you’ll be listed specifically according to the path you’ve chosen to take:

“Verified” Offerings

To be listed as one of the verified statuses, you must meet different thresholds of security requirements and provide the results of an independent audit conducted by a 3PAO that confirms such:

StateRAMP Requirements

How Do I Determine My StateRAMP Requirements?

Like FedRAMP requirements, StateRAMP requirements are taken from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4. (While Revision 5 has been published, StateRAMP is still currently in the process of transitioning to leveraging it; however, any packages submitted after October 1, 2024, will be required to leverage NIST SP 800-53 Revision 5.)

In determining those your organizations must meet, you must first determine your baseline, and that’s based on the data you handle:

• Low: The ground level that any CSP must meet—requires 153 (at Rev 5) controls for compliance and generally maps to data or systems that involve publicly available data.

• Moderate: This baseline requires 319 (at Rev 5) security controls for compliance and generally maps to data or systems that involve confidential data or of high criticality to the continuity of government.

If you’re familiar with FedRAMP, you may have noticed the conspicuous absence of a High impact baseline. That’s because—at this time—StateRAMP does not authorize these, as most state agencies fall into the Low or Moderate impact areas. That being said, some CSOs are listed as High impact and those were granted authorization via FedRAMP reciprocity.

Is Penetration Testing Required for StateRAMP?

Yes. And while StateRAMP did release its own penetration testing guidance, it’s the same methodology as that for FedRAMP.

StateRAMP Authorization Boundary Guidance

When obtaining StateRAMP authorization, many of the headaches occur around the Authorization Boundary and diagrams.

Thankfully, much of StateRAMP’s Authorization Boundary guidance is the same or seeks the same goals as FedRAMP. Moreover, StateRAMP has defined what’s necessary to depict within the Authorization Boundary Diagrams, Network Diagram, and Data Flow Diagrams, and by and large, it’s the same as FedRAMP—meaning, the same scrutiny used at the FedRAMP level should be used for StateRAMP.

What Data Types Must Be Included in My StateRAMP Authorization Boundary?

First and foremost, you must account for—and include within the authorization boundary—any data that is created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for a State, Local, or Education Institution (SLED) customer, in any medium or form that passes within your cloud service offering. Some examples include:

• Mission-based information
• Financial management information
• Human Resources data
• IT management data
• Citizen/taxpayer information
• Third-party supplier information

That being said, SLED data can also be broken down into different categories that may make it easier for you to identify it when preparing for StateRAMP:

What about Corporate Services and Metadata?

Though SLED and SLED Metadata in their different subcategories must be included in your Authorization Boundary, data about processes within the authorization boundary or SLED customers that do not contain security-sensitive information and/or information that if compromised could be a threat to the systems supporting the processing and storage of SLED data, SLED metadata or SLED personnel data.

For example:

• IT utilization and performance data
• Project planning information
• Marketing materials
• Pricing data

External systems processing or storing corporate metadata may have active connections to the authorization boundary, but all connections must be examined and the 3PAO must validate the type of information transmitted in the connection during initial authorization and during the annual assessment to ensure the data types do not reflect more sensitive data.

Again, only those corporate systems and services that do not contain SLED data or metadata may exist outside of the authorization boundary—any that do contain that information must meet the same security requirements that your CSO must meet and be brought into the scope of your assessment.

How Do I Account for External Services/Interconnections within My StateRAMP Authorization Boundary?

An interconnection is the use of another information system or cloud system to share data and other resources—that includes external services used to support the system. While StateRAMP encourages CSPs to leverage other StateRAMP service providers—as well as FedRAMP-authorized services—you aren’t forced to do so.

That being said, if you do choose to leverage an external service without a StateRAMP status of Authorized or a FedRAMP authorization, you should know that:

• You will be limited to obtaining a Provisional StateRAMP authorization. Moreover:

• Your leveraged service must undergo the StateRAMP Snapshot process and you’d be limited to a Provisional status until all external systems and services are StateRAMP authorized.

(Your letter awarding the Provisional status will include a list of controls and/or third-party systems that must be remediated before you can be awarded full authorization.)

• For you to achieve full Authorization, your external services must:
  • Achieve StateRAMP or FedRAMP authorization; or
  • You must move the product or service into the authorization boundary; or
  • You must discontinue the use of the unauthorized service and move to a product with a current StateRAMP or FedRAMP authorization.

How Do I Depict All This in My Diagrams?

Luckily, StateRAMP adopted a very similar set of guidelines for Authorization Boundary, Network, and Data Flow, and you can find all the particulars here.

How Schellman Can Help

Does Schellman Perform StateRAMP Assessments?

We do, and we’ve gained a lot of experience in these assessments since we performed our first one in 2022.

If you’ve previously worked with us on your FedRAMP assessment, you can expect essentially the same project scope, engagement length, fees, and type of deliverables—Security Assessment Plan (SAP), Security Assessment Report (SAR), Risk Exposure Table (RET), Penetration Test Report—though StateRAMP does have specific templates for those that we use.

Does Schellman Perform StateRAMP Consultancy Services?

At this time, we do not offer any consultant services for any compliance initiative.