Get authorized to serve state and local government

What is StateRAMP?

StateRAMP is a nonprofit program that brings a standardized, FedRAMP-style approach to cloud security for state and local governments. Like FedRAMP, it is based on the NIST SP 800-53 control catalog and uses accredited third-party assessment organizations (3PAOs), and it maintains an Authorized Product List (APL) of cloud offerings that government agencies can procure with confidence.

Baselines and status

StateRAMP uses Low, Moderate, and High impact baselines drawn from NIST 800-53. Providers progress through recognized statuses — from an early-stage Security Snapshot to Ready and ultimately Authorized — reflecting how far an offering has advanced through assessment and continuous monitoring. Authorization requires a government sponsor or review through the StateRAMP PMO.

FedRAMP reciprocity

Because StateRAMP and FedRAMP share the same NIST 800-53 foundation, StateRAMP offers reciprocity: a provider's FedRAMP authorization work can be leveraged toward StateRAMP status, and a single 800-53 control program can serve both federal and state/local buyers.

How episki helps

episki ships the NIST 800-53 baselines as living controls, generates the System Security Plan from real evidence, tracks the POA&M and monthly continuous-monitoring deliverables, and cross-maps everything to FedRAMP — so reaching the StateRAMP Authorized Product List builds on work you are already doing rather than starting a separate project.