GovRAMP

What GovRAMP does

GovRAMP, legally StateRAMP Inc, is a 501(c)(6) nonprofit membership organization headquartered in Indianapolis, Indiana, that operates a NIST-based cloud security verification framework for state, local, tribal, and educational government organizations and the cloud service providers serving them. Originally founded as StateRAMP and rebranded to GovRAMP, the organization runs a two-sided marketplace in which governments obtain standardized cloud security requirements and providers obtain verified security status recognized across participating jurisdictions. As of the source data, GovRAMP counts 1,200+ member organizations, 70 participating government entities, 330 products in the program, 29 accredited Third-Party Assessment Organizations (3PAOs), and adoption by 11 U.S. states (Arizona, Indiana, Massachusetts, Minnesota, Nevada, New Hampshire, North Carolina, North Dakota, Oregon, Texas, Utah). Nevada and North Carolina codified GovRAMP as the statewide cloud security standard with effective dates in 2026.

The organization's core technology is a tiered verification framework built on NIST 800-53, with five progressive pathways: Security Snapshot (40 controls, 12-month assessment), Progressing Security Snapshot (ongoing 40-control assessment), Core Verification (60 controls, PMO-validated without 3PAO), Ready Verification (80 controls, 3PAO-assessed with monthly continuous monitoring), and Authorized/Provisional Verification (300+ controls, 3PAO-assessed with monthly continuous monitoring). A Fast Track program allows providers with existing FedRAMP documentation (RAR, SAR, ConMon) to accelerate GovRAMP verification. Supporting programs include the 3PAO Discount Program offering up to 30% assessment discounts, the Program Participants List (unified Authorized and Progressing Product Lists), the Framework Harmonization Working Group, the CJIS-Aligned Task Force, and an AI Task Force. Program operations are executed through RAMPQuest (formerly Knowledge Services) as the founding Program Management Office.

The business model is nonprofit membership-based. Private sector members subscribe annually at five tiers: Basic ($1,500), Prime ($2,500), Premier ($10,000), Elite ($25,000), and Champion ($50,000), all renewing on June 1. Discounted small-business tiers range from $500 to $1,750 for organizations with up to $5M in annual revenue. Public sector and education organizations receive free membership. Distribution combines a self-serve membership portal (members.govramp.org), a dedicated Government Engagement Team, a 29-3PAO channel network, and strategic partnerships with hyperscalers (AWS, Microsoft, Google), security vendors (Zscaler, CrowdStrike, Fortinet, Wiz, Varonis), associations (NASPO, NASCIO, MS-ISAC), and government reseller Carahsoft.

Name

GovRAMP

Legal name

StateRAMP Inc dba GovRAMP

Website

https://govramp.org

Company type

Private

Operating status

Operating

Headcount range

11–50 employees

Short description

GovRAMP is a nonprofit membership organization operating a NIST-based cloud security verification framework for state, local, tribal, and educational governments and the cloud service providers serving them, standardizing assessments across 1,200+ member organizations and 11 adopting U.S. states.

Ownership category

akta.pro rank

Product category

Cloud Security Certification Services

NAICS

National Security and International Affairs (9281), Administration of Economic Programs (9261), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Computer Processing & Data Preparation (7374), Services-Management Services (8741)

akta.pro primary industry

Cloud Security Services (Posture Mgmt, Workload Protection) (BPAKAHAK)

akta.pro secondary industries

Government Digital Service & eGovernment (Service Delivery, IDs, Portals) (BPAIAAAE), Secrets Management & Cloud Key Management (KMS, Vaults) (HDADADAK), Policy, Governance & Compliance Management for Private Cloud (HDABABAI)

Keywords

• Cloud security verification
• Government cloud certification
• NIST compliance framework
• Third-party assessment
• Security authorization services

Headquarters

HQ city

Indianapolis

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Others

Revenue model

1. Private Sector Membership: Annual membership fees at multiple tiers for service providers, consultants, advisory firms, and 3PAOs. Membership renews annually on June 1. Basic tier at $1,500, Prime at $2,500, Premier at $10,000, Elite at $25,000, and Champion at $50,000 annually.
2. Small Business Membership: Discounted membership pricing for qualifying small businesses based on annual revenue. For businesses with up to $1M revenue: Basic $500/annually, Prime $850/annually. For $1M-$5M revenue: Basic $1,000/annually, Prime $1,750/annually.
3. Public Sector Membership: Free membership for eligible government and education organizations including state, local, tribal, and education organizations as well as individual professionals within those organizations.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels8 records

Core offering

GovRAMP delivers a NIST-based cloud security verification framework that enables U.S. state, local, and tribal governments to assess the cybersecurity posture of cloud service providers prior to procurement. Its service portfolio includes tiered verification statuses (Ready and Authorized/Provisional), a Fast Track pathway for FedRAMP-authorized products, an Authorized Product List of verified offerings, and a membership program with five private-sector tiers plus free public-sector participation.

Product overview

GovRAMP provides a nonprofit cloud security verification ecosystem for government procurement. The core offering is a tiered Security Program with five verification pathways: Security Snapshot (40 NIST controls, 12-month assessment), Progressing Security Snapshot (ongoing assessment with 40 NIST controls), Core Verification (60 NIST controls, PMO-validated without 3PAO requirement), Ready Verification (80 NIST controls, requires 3PAO assessment), and Authorized/Provisional Verification (300+ NIST controls, comprehensive 3PAO assessment). The Fast Track program enables providers with existing FedRAMP documentation to accelerate their GovRAMP journey. GovRAMP also offers a tiered private sector membership model (Basic at $1,500, Prime at $2,500, Premier at $10,000, Elite at $25,000, and Champion at $50,000 annually) providing access to the security program, PMO guidance, networking, and visibility benefits. The 3PAO Discount Program provides up to 30% assessment discounts for providers completing Progressing or Core Verification. For small businesses, discounted memberships are available (Basic from $500, Prime from $850 annually). The Program Participants List (unified APL/PPL) enables government buyers to discover verified providers.

Differentiator

Problem solved

Functional benefit

Brands

• GovRAMP: The primary brand name under which StateRAMP Inc operates, representing its cloud security verification framework and programs for government.

Products and services

• GovRAMP Ready Verification
• GovRAMP Authorized (Provisional) Verification
• Fast Track Verification Program
• GovRAMP Authorized Product List
• GovRAMP Membership Program

Quantifiable outcome

• Service providers improve security controls by 40-60% in first year of participation
• +1 more outcomes

Named customers11 records

Segments5 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature6 records

Partnerships

21 partnerships are on record, tiered core, champion, elite and strategic.

• RAMPQuestcoreStrategic or Co-development PartnerRAMPQuest serves as the founding Program Management Office (PMO) for GovRAMP, supporting program development, operations, and ongoing advancement. Previously operated as Knowledge Services, RAMPQuest rebranded to reflect its specialized mission in cybersecurity and compliance services. The company guides technology providers and public-sector partners through structured security alignment and continuous monitoring.
• A-LIGNchampionGTM or Marketing PartnerA-LIGN is a Champion-level GovRAMP member and participates in the 3PAO Discount Program, offering discounted assessment rates for providers completing Progressing Security Snapshot or Core verification.
• CoalfireeliteGTM or Marketing PartnerCoalfire is an Elite-level member of GovRAMP and participates in the 3PAO Discount Program, offering assessment discounts up to 30% for prepared providers.
• ZscalerstrategicGTM or Marketing PartnerZscaler is a strategic member supporting GovRAMP's mission to advance secure cloud adoption for government.
• AWSstrategicGTM or Marketing PartnerAmazon Web Services supports GovRAMP as a strategic member, helping cloud providers demonstrate security posture on AWS for government customers.
• MicrosoftstrategicGTM or Marketing PartnerMicrosoft is a strategic member supporting GovRAMP's standardized cloud security framework for government adoption.
• GooglestrategicGTM or Marketing PartnerGoogle Cloud is a strategic member of GovRAMP supporting secure cloud adoption across government.
• CarahsoftstrategicChannel Partner/ Reseller/ DistributorCarahsoft is a Premier sponsor of the GovRAMP Cyber Summit and a key channel partner for government technology procurement.
• NASPOstrategicGTM or Marketing PartnerNational Association of State Procurement Officials supports GovRAMP as a strategic partner helping standardize cloud security procurement across states.
• NASCIOstrategicGTM or Marketing PartnerNational Association of State Chief Information Officers collaborates with GovRAMP on framework harmonization and cybersecurity policy advocacy.
• MS-ISACstrategicGTM or Marketing PartnerMulti-State Information Sharing and Analysis Center partners with GovRAMP to strengthen cybersecurity across state and local governments.
• CrowdStrikestrategicGTM or Marketing PartnerCrowdStrike is a strategic member supporting GovRAMP's mission to advance cybersecurity for the public sector.
• FortinetstrategicGTM or Marketing PartnerFortinet is a strategic member contributing to GovRAMP's cloud security ecosystem.
• FortreumcoreTechnology or IntegrationFortreum is an Elite member of GovRAMP and participates in the 3PAO Discount Program, providing independent security assessments for cloud service providers.
• Prescient SecuritycoreTechnology or IntegrationPrescient Security is an Elite member and participates in the 3PAO Discount Program, conducting independent assessments for GovRAMP verification.
• VaronisstrategicGTM or Marketing PartnerVaronis is a Premier member supporting GovRAMP's secure cloud adoption mission.
• WizstrategicGTM or Marketing PartnerWiz is a Premier member of GovRAMP supporting cloud security standards for government.
• OmnissastrategicGTM or Marketing PartnerOmnissa is a Premier member supporting GovRAMP's standardized cloud security framework.
• BillingtonstrategicGTM or Marketing PartnerBillington State & Local Cybersecurity Summit collaborates with GovRAMP on cybersecurity events and policy discussions.
• NevadacoreStrategic or Co-development PartnerState of Nevada adopted GovRAMP as the statewide standard framework for cloud security verification across executive branch agencies, effective July 1, 2026. This partnership reduces duplicative agency-by-agency security reviews and creates predictable requirements for vendors.
• North CarolinacoreStrategic or Co-development PartnerState of North Carolina partnered with GovRAMP to strengthen and standardize cloud security requirements across state agencies, reinforcing commitment to protecting digital services and citizen data. Requirements effective April 1, 2026.

Scale indicators5 records

Recent moves7 records

Expansion highlights6 records

Direct peers

• HITRUST: Operates a widely adopted assurance framework (HITRUST CSF) with third-party assessors and tiered certification pathways. Comparable to GovRAMP in being a nonprofit, community-driven security assurance program used by regulated organizations.
• FedRAMP: The federal-level cloud security authorization program that GovRAMP explicitly mirrors and complements. Both are NIST-based authorization frameworks with PMO-managed verification pathways and 3PAO-conducted assessments; GovRAMP's Fast Track program actually reuses FedRAMP documentation.
• TX-RAMP: Texas's state-level cloud security certification program administered by the Texas Department of Information Resources. Although Texas has now also adopted GovRAMP, TX-RAMP historically competed as an alternative state-level cloud verification framework.

Broad incumbents

• Center for Internet Security (CIS): Operates widely adopted cybersecurity best-practice frameworks (CIS Controls, CIS Benchmarks) used by state and local governments. Adjacent to GovRAMP as a community-driven standards body informing cloud security expectations in the public sector.
• Cloud Security Alliance (CSA): Global nonprofit organization producing cloud security research, certifications (CCSK, STAR), and best-practice frameworks. Comparable to GovRAMP as a community-led cloud security standards organization with broad membership.
• ISO 27001 Certification Bodies (e.g., ISO/IEC 27001): The international information security management standard commonly used by cloud service providers as an alternative or complement to GovRAMP/FedRAMP for global government and enterprise customers.
• AICPA (SOC 2): Publishes the SOC 2 trust services framework used widely by cloud service providers selling to government and enterprise. SOC 2 is often run alongside GovRAMP verifications for cloud providers serving state buyers.

Emerging players

• RAMPQuest: The dedicated cybersecurity and compliance services brand spun out of Knowledge Services to serve as GovRAMP's founding PMO. Operationally intertwined with GovRAMP but commercially a separate services entity offering assessment and compliance support.
• Schellman: A2LA-accredited assessment firm providing FedRAMP, SOC 2, ISO 27001, and similar third-party assessments to cloud providers. Comparable as a 3PAO-style assessor adjacent to GovRAMP's verification ecosystem.

Regional players

• CJIS Security Policy: FBI-administered security policy governing criminal justice information access. Many state government cloud buyers must align with both CJIS and GovRAMP; GovRAMP even has a dedicated CJIS-Aligned task force.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/GovRAMP
• YouTubeyoutube.com/@GovRAMP
• LinkedInlinkedin.com/company/govramp

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about GovRAMP