3 Things You Should Know About StateRAMP

When organizations opt to pursue a new compliance initiative, aside from cost and necessary resources, the first thought is usually regarding what to expect. That’s true for StateRAMP as well, and though many may—correctly—assume that there are some similarities between it and the more popular FedRAMP, there are several very clear deviations by the former from the latter that you know about going in.

As long-time 3PAOs for both programs, we understand the benefits of pursuing StateRAMP just as we understand these nuances. In this blog post, we’re going to highlight three significant distinctions in StateRAMP so that—as you move forward—you can map out the best pursuit of Authorization for your organization.

3 StateRAMP Highlights

You might be wondering why StateRAMP included these differences in its program when it has the same overarching goal as FedRAMP—to secure products and services in use by government agencies.

The answer is that FedRAMP preceded StateRAMP by a decade, and in that time, creators of the latter reviewed the former’s history and have since taken opportunities to improve upon what had become known FedRAMP headaches—hence StateRAMP’s proven track record for designing unique program enhancements and novel approaches that make it easier for cloud service providers (CSPs) to become a StateRAMP member and provide their product to state, local, and education (SLED) organizations.

Below are three such improvements in notable areas.

1. Fast Track (Reciprocity)

In 2022, StateRAMP began a reciprocity program called Fast Track. Perhaps you can guess where this is going—being that StateRAMP is a more localized version of FedRAMP, FedRAMP-authorized CSPs can submit an application and review of their FedRAMP packages for approval from StateRAMP. If your package is approved, StateRAMP will list then you on the StateRAMP marketplace, thereby streamlining the process.

What’s more, is:

• In many cases, you don’t even need to be fully approved at the FedRAMP Ready or Authorized levels to start this StateRAMP Fast Track process. Once you’ve completed your security package and submitted it to FedRAMP, you can also submit it to StateRAMP at that point—considering the typically long wait times for PMO review on the FedRAMP side, this could be a smart move to get your organization added to the StateRAMP Marketplace sooner.
• Conversion to StateRAMP-specific templates is not required at this time.

If you were to pursue the Fast Track, you’d generally progress through the following steps:

1. Become a StateRAMP member and engage the StateRAMP PMO.
2. Complete the required onboarding documentation.
3. Meet with the PMO and discuss your security package (i.e., your FedRAMP security package that includes the System Security Plan (SSP), Security Assessment Plan (SAP), and Security Assessment Report (SAR).
4. Wait as the StateRAMP PMO reviews your package—it will highlight anything concerning and discuss it with you.
5. Perform the required continuous monitoring and supply that evidence to StateRAMP.

As wholly beneficial as this avenue seems, there is one thing you should note—CSP sensitive security system information is inherently shared with StateRAMP, which could cause concern for CSPs, federal agencies, and the FedRAMP PMO. If that’s true for you, take care in communicating the sharing of FedRAMP data with all stakeholders and discuss concerns raised with the StateRAMP PMO.

2. Non-Sponsor Assessment Package Review (StateRAMP Approvals Committee)

First rolled out in 2022, the StateRAMP Approvals Committee now allows CSPs without a StateRAMP sponsor to still submit an initial security package for authorization review to the StateRAMP Approvals Committee and gain either an Authorized or Provisional authorization status.

You might be thinking that sounds fairly similar to the FedRAMP Joint Authorization Board (JAB), but in fact, the StateRAMP Approvals Committee isn’t as selective—it operates first-in-first-out (queue), and they report a review rate of 2-3 packages per month.

Finding a sponsor can be difficult, and so opening up this avenue permitting cloud service providers to still make progress in their StateRAMP journey regardless could be a game-changer for some organizations.

3. StateRAMP Snapshot

As an additional helpful boon, CSPs can apply for, pay a fee, and submit evidence to the StateRAMP PMO for an official StateRAMP security score—it’s called a “Snapshot,” and it functions essentially like a gap assessment in that this review focuses solely on where you stand regarding just 38 NIST controls StateRAMP has deemed of high importance.

You have two options when pursuing a Snapshot:

Some other key points of the StateRAMP Snapshot program include:

• The evidence you submit for your Snapshot can include other recent assessment reports, such as SOC or ISO (which could help reduce the level of effort necessary in your evidence collection).

• The StateRAMP PMO claims they will turn around a review within 3 weeks of payment and all evidence is uploaded.

• You can receive a score of anywhere between 0-100, with 100 being a perfect score.

• In preparation for Revision 5, StateRAMP adopted a weighted scoring system for the Snapshot Program, based on NIST/MITRE framework study. More detailed scoring criteria—including those NIST controls with MITRE Control Value and Score Percentage—can be found here: Snapshot Criteria and Scoring.
  • Column D—Score Percentage—notes the weight of each control and you’ll be able to see how they all add up to 100.

• Snapshot scores are not published by StateRAMP, but you can decide to publish or share them at your discretion.

• Official Snapshot is valid for 1 year, and there’s no limit to the number of snapshots or how often you can get them.

Moving Forward with StateRAMP

If you’re seeking to open the door to a new market that is SLED organizations, StateRAMP may be a necessary obstacle to overcome. And while those already familiar with FedRAMP might have a slight leg up in knowing what to expect, but there are some specific deviations in StateRAMP to know about so that you can take advantage (or not).

Now that you do know more regarding some of the unique aspects of StateRAMP, you may feel comfortable enough to move forward, but if not, reach out to us—our team of experts would be happy to answer any questions you have about StateRAMP so that you can build the right compliance portfolio for your organization.