Technology
StateRAMP and FedRAMP, explained
What the two cloud security authorization programs are, how they differ, and what an authorization actually tells an agency.
Both programs exist to answer the same question: has this cloud service's security been assessed against a recognized standard by an independent party? They differ in who runs them and who relies on them.
FedRAMP
The Federal Risk and Authorization Management Program is the federal government's program for authorizing cloud services used by federal agencies. Services are assessed against NIST SP 800-53 control baselines at defined impact levels by accredited third-party assessment organizations, and authorizations are granted by a federal authorizing official or a joint board. Federal agencies can then reuse the authorization rather than assess the service themselves.
StateRAMP
StateRAMP is a nonprofit program modeled on FedRAMP for state and local governments. It uses the same NIST SP 800-53 foundation and third-party assessment approach, with impact levels and a status hierarchy that reflects a provider's progress from initial engagement to full authorization. Participating states and local governments can rely on StateRAMP status in procurement.
What an authorization tells you
That the provider's controls for a specific service, at a specific impact level, were assessed and found to meet the baseline at a point in time, with continuous monitoring afterward. It does not tell you the agency's configuration is secure, that the specific features you use are in scope, or that the provider's other products are covered.
How agencies use them
- Requiring authorization for cloud services that will hold moderate or high impact data
- Accepting authorization in place of a full agency assessment
- Verifying the authorization scope against the intended use
What to expect from vendors
Obtaining authorization is a significant investment. Vendors often build on authorized platforms and inherit many controls, then document the remaining ones. Companies offering services rather than cloud products, such as HQT, are typically not authorized themselves but work within authorized environments.
Terminology caution
"FedRAMP ready," "in process," "aligned with," and "equivalent" are not authorizations. Agencies should verify status through the programs' published marketplaces.