StateRAMP Assessment & Authorization

What is StateRAMP?

In 2011, the Federal Risk and Authorization Management Program (FedRAMP) was introduced, offering a framework for federal agencies to manage risk in commercial cloud service provider environments through a standardized assessment methodology. Recognizing FedRAMP’s advantages for the federal sector, the State Risk and Authorization Management Program (StateRAMP) was formed in 2021. This initiative addresses the increasing need for state and local governments to effectively handle third-party risks in commercial cloud environments, introducing an efficient methodology to verify the security posture of cloud environments.

StateRAMP implements a robust security assessment framework with the primary objective of assisting agencies that are transitioning to secure and dependable cloud-based solutions. Cloud service providers (CSPs) intending to offer cloud services to state and local governments must demonstrate compliance with the NIST 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations) and StateRAMP-specific security controls. Compliance assessments are performed by Third Party Assessment Organizations (3PAOs), accredited by the American Association for Laboratory Accreditation (A2LA) and authorized by the FedRAMP program management office (PMO).

What is a StateRAMP assessment?

Following the FedRAMP model, Linford & Company provides StateRAMP compliance certification services, commonly known as StateRAMP authorization. These services are designed to assist organizations in demonstrating their adherence to cloud security controls and fulfilling the requirements of the StateRAMP program. Cloud Service Providers (CSPs) seeking Authorization to Operate (ATO) can leverage our comprehensive StateRAMP compliance assessments and certification services which encompass the following key components:

1. Pre-assessment/gap analysis: Evaluating a CSP’s readiness for the StateRAMP process, including reviews of boundary definitions, documentation, and high-priority control implementations.
2. Assessment planning and Security Assessment Plan (SAP) development.
3. Assessment/testing execution against NIST 800-53 controls and StateRAMP control enhancements, to include penetration testing
4. Assessment reporting and final package development for submission to the StateRAMP PMO or relevant state agencies.
5. Annual assessments, including penetration testing, of the system after initial ATO award.

Assessment of StateRAMP security controls and associated documentation, policies, and compliance procedures requires an independent A2LA accredited and FedRAMP-approved Third Party Assessment Organization (3PAO) assessor. This assessor should possess a background and expertise in StateRAMP controls, assessment processes, and the capability to document compliance. Linford & Company takes pride in being an accredited 3PAO, ensuring the credibility and proficiency of our certification services.

What is the value of a StateRAMP assessment?

Companies seeking StateRAMP authorization are CSPs aiming to offer their services to state and local governments. The StateRAMP compliance assessment stands out from other methodologies by comprehensively examining the entirety of an organization’s cloud environment, including people, processes, and technology. This assessment demands extensive documentation, often spanning hundreds of pages, and necessitates an ongoing commitment to upholding control environments through rigorous continuous monitoring.

Achieving StateRAMP authorization holds immense value for cloud service providers by significantly expanding their market reach through the demonstration of compliance with a rigorous security framework like StateRAMP. With the “do once, use multiple times” approach, once an organization secures Authorization to Operate (ATO) from a state or local agency (or directly from the StateRAMP PMO), this authorization can be leveraged across multiple state and local government agencies. This strategic advantage enables the marketing of cloud services across a broad spectrum of state and local government entities.