State RAMP FAQ

Cybersecurity risks have proliferated ceaselessly over the years, and state governments have been a prime target of those attacks. State governments handle vast troves of personal, financial, or healthcare data; their IT security budgets are often meager; and the IT infrastructure they use can be filled with security holes. 

So from the criminals’ perspective, why wouldn’t you go after state governments? They’re easy targets. 

State governments are, of course, aware of their vulnerability. One strategy they use to improve their cybersecurity and reduce risk is the program known as StateRAMP — a way to verify the security of cloud-based software providers, before states start doing business with those providers. 

In this post let’s dive into what StateRAMP is, how it helps with cybersecurity, and how it differs from a similar government program, FedRAMP.

What Is StateRAMP?

StateRAMP — shorthand for the State Risk and Authorization Management Program  — is a platform that offers states a way to verify that the cybersecurity of their cloud-based service providers is up to snuff. StateRAMP authorization helps to advance cybersecurity standards for state government operations and to keep personal data safe. 

The framework is simplified from the larger federal government version, FedRAMP. As described by Leah McGrath, executive director for StateRAMP, the program “helps bring state and local government together to create that common method, and assist state and local governments in managing the third-party service providers, when it comes to cloud security and cybersecurity.”

StateRAMP has a small board of directors, plus a larger steering committee composed of executives from the cybersecurity sector and from state and local governments. The platform also relies on NASCIO, the National Association of State Chief Information Officers, to help develop technical policies and standards for StateRAMP. 

What Is the Purpose of StateRAMP?

StateRAMP exists to help state and local governments evaluate the cybersecurity of software-as-a-service (SaaS) vendors. It produces templates that third-party assessment organizations (3PAOs) can use to evaluate the security of a SaaS vendor, and provide a StateRAMP “seal of approval” for those cloud-based vendors. Then CIOs and procurement officers in state and local governments can have more assurance that the technology vendors they might use will have satisfactory data protection safeguards in place. 

How Do StateRAMP and FedRAMP Differ?

FedRAMP was established in 2011 by the Office of Management and Budget, which acts as a combination CFO and COO function for the federal government. Its goal was to foster better collaboration between government officers and cloud-based service providers on cybersecurity issues. 

To that end, FedRAMP develops templates to help 3PAOs assess the security of cloud-based providers. Those templates help federal agencies keep pace with new technologies and the changing nature of cybersecurity risk; and today the FedRAMP framework is used across the entire U.S. federal government. 

StateRAMP is, essentially, a simplified version of FedRAMP. It uses the same framework and model as FedRAMP, but it’s meant to be used on a smaller scale and focuses on state and local government issues. Also remember that while the two programs are similar in design and primary objective, StateRAMP and FedRAMP are separate entities. 

Why Is StateRAMP Important to Use?

State and local governments will continue to embrace cloud-based technology providers. And they should embrace cloud-based vendors, too. The costs are lower, implementation is easier, and the technology runs better than what most government agencies could develop and operate themselves. 

The question is how to square that trend in IT adoption with the proliferation of cybersecurity threats we mentioned earlier. Evaluating the security of every cloud-based vendor can be a challenging task for state and local IT departments — so relying on StateRAMP gives them a level of assurance they might not otherwise achieve. 

How ZenGRC Can Help with StateRAMP Compliance

The need for software automation to regulate security measures still remains the most reliable option. Using automation for managing security is necessary: whether you’re a government organization at any level or a private company, it’s expected that security risks will continue to grow.

ZenGRC takes the headaches out of managing StateRAMP compliance by guiding you through the framework step by step. 

ZenGRC’s central dashboard allows you view your organization’s complete compliance stance through a single pane of glass, showing you where gaps exist  and what steps or documentation are required to fill them. 

When it’s time to hire a third-party auditor, ZenGRC enables you to save time and money by organizing all of your compliance documentation with a pre-made compliance template that is easy to access when needed. 

If you’d like to see ZenGRC in action, contact us today for a free demo.