Your cloud software has cleared a rigorous security review. Then a potential customer in another state asks for more paperwork, a different validation process, or proof that your existing security status qualifies under its procurement rules. How can one product face multiple paths to approval, even when the underlying security controls are largely the same?
That is where StateRAMP, now called GovRAMP, enters the picture. GovRAMP provides a shared cloud security verification framework for participating state, local, tribal, and education governments, while FedRAMP serves federal agencies. Texas operates its own TX-RAMP certification. Other states, including Indiana, North Carolina, Nevada, Georgia, Utah, Oregon, and Arizona, apply GovRAMP through different policies, recognition processes, and requirements.
For cloud software and AI vendors, those differences can affect eligibility, costs, and how quickly a product reaches government buyers. This guide explains StateRAMP (GovRAMP), FedRAMP, TX-RAMP, and other state RAMP programs, including verification levels, reciprocity, and what to check before bidding. It draws on official materials reviewed November 6, 2026; the current solicitation and applicable state guidance govern any specific procurement.
StateRAMP, GovRAMP and FedRAMP at a glance
StateRAMP and GovRAMP are the same program. StateRAMP changed its public name to GovRAMP in February 2025; existing statuses remained valid.
FedRAMP serves federal agencies, while TX-RAMP is an independently administered Texas state certification. Indiana RAMP is a state policy that relies on GovRAMP verification; Arizona is moving away from legacy AZ-RAMP.
North Carolina, Nevada, Georgia, Utah and Oregon use the shared GovRAMP framework with different implementation rules, covered contracts and verification thresholds.
Bottom line for vendors: check the precise cloud offering, verified status, state data classification, reciprocity process and award deadline. A security report that meets one program does not automatically satisfy another.
What is StateRAMP (GovRAMP) certification?
First, an essential naming clarification: StateRAMP announced its rebrand on February 14, 2025. The nonprofit legal entity remains StateRAMP, doing business as GovRAMP. Existing StateRAMP memberships and verified security statuses carried forward. A vendor does not need one StateRAMP certification and a second GovRAMP certification; they are the same program under its new public name.
GovRAMP is a reusable security verification pathway for a specific cloud service offering, not a blanket certification of an entire company. A provider selects its service boundary and appropriate Low, Moderate, or High impact level, prepares NIST-based evidence, and progresses through appropriate program statuses. Security Snapshot assesses an initial set of 40 controls; Progressing Snapshot tracks improvement; Core validates 60 foundational controls through the GovRAMP program management office; Ready relies on independent 3PAO assessment of readiness; Authorized and Provisionally Authorized require more extensive third-party review, approval, and continuous monitoring.
Ready does not mean fully Authorized, and a product merely appearing on the Progressing Product List is not the same as an approved Authorized offering. GovRAMP maintains both its Authorized Product List and Progressing Product List. A government buyer must still determine whether the verified impact level, system boundary, and current status meet that buyer's procurement rules.
Sources: GovRAMP's StateRAMP rebrand announcement; GovRAMP product verification lists; GovRAMP frequently asked questions.
How does StateRAMP (GovRAMP) verification work?
1. Define the service offering and system boundary. Identify where the cloud product stores, processes or transmits government data and which state buyers it will serve.
2. Select the required impact level and verification status. Snapshot and Core represent earlier assurance stages; Ready is not the same designation as Authorized.
3. Prepare security evidence. Align documentation and control implementation with the applicable NIST-based requirements, address gaps, and work through the GovRAMP process.
4. Complete validation or independent assessment. Higher assurance levels, including Ready and Authorized, involve an independent third-party assessment organization (3PAO).
5. Maintain the verified status and check state conditions. Ongoing monitoring and state-specific reciprocity, CJIS, tax-data or procurement obligations may still apply. Confirm the exact current requirements with GovRAMP and the purchasing agency.
FedRAMP vs StateRAMP (GovRAMP) vs TX-RAMP
FedRAMP is the federal government's program for assessing and certifying cloud services. Its traditional NIST SP 800-53 Revision 5 approach includes Low, Moderate, and High impact baselines. In 2026, the General Services Administration introduced the FedRAMP 20x certification model, emphasizing measurable security outcomes, automated evidence, and progressively higher assurance classes. Class A is an entry point for services with mature external security assessments; Classes B and C are also available. Class D is still in development. A FedRAMP certification does not automatically resolve every state-specific procurement condition.
GovRAMP, formerly StateRAMP, is a nonprofit framework used by participating public-sector organizations. Its statuses include Security Snapshot (40 NIST controls), Core (60), Ready (80, involving an independent assessment), and Provisional/Authorized (300 or more, also involving an independent assessment). A Snapshot or a place on a progressing list should not be confused with a full authorization. States decide which status they require based on data and risk.
TX-RAMP is Texas's separate state-run program, administered by the Texas Department of Information Resources (DIR). Its current statutory basis is Texas Government Code section 2063.408. The February 2026 TX-RAMP Program Manual lists 117 assessed controls and enhancements for Level 1 and 223 for Level 2. Texas can recognize qualifying FedRAMP and GovRAMP statuses, but the vendor must request reciprocity and DIR must validate the product and status. Recognition is not automatic.
These systems share substantial NIST based security foundations. They do not always share a single certificate, monitoring arrangement, or route to procurement approval.
Which states have their own RAMP programs?
Three operating models matter. First, Texas runs a distinct state-issued TX-RAMP assessment and certification program, with separate submissions and formal reciprocity for eligible GovRAMP and FedRAMP offerings. Second, Indiana calls its statewide policy Indiana RAMP but generally uses GovRAMP status and continuing oversight as the required verification method. Third, other states incorporate GovRAMP into state procurement policy without creating a new independently issued state RAMP certificate.
Arizona shows how a fourth situation can evolve: its AZ-RAMP program is transitioning to GovRAMP, moving away from the legacy state-specific route. The phrase 'state RAMP' therefore refers to different things across jurisdictions: a distinct authorization, a named state policy, a retired legacy program, or participation in the shared GovRAMP framework. Those are not interchangeable.
StateRAMP/GovRAMP does not itself impose a single nationwide mandate. An organization appearing in GovRAMP's directory may be exploring, planning, or implementing the program. Statewide obligations must be established through that jurisdiction's actual procurement policy, law, executive order, or contract.
Sources: Indiana RAMP policy; Arizona GovRAMP transition; participating government organizations.
State RAMP Requirements by State
Utah and Oregon GovRAMP requirements
Utah adopted GovRAMP-linked cloud procurement requirements effective July 1, 2025. For covered purchases, cloud providers and resellers must present a product engaged with GovRAMP or FedRAMP Revision 5 unless Utah instructs otherwise. This is a state-specific contract-entry rule built on shared frameworks, not a new UT-RAMP certification.
Oregon uses GovRAMP within its Cloud and Hosted Systems Statewide Policy. For applicable procurements, the state may require a product to reach GovRAMP Authorized status by a contractual deadline, while accepting Progressing Snapshot, Core, or Ready as interim steps. Oregon expressly says the rule does not cover every cloud contract or intergovernmental and educational arrangement.
These additions produce a more accurate comparison: Texas (distinct state-issued certification); Indiana (state RAMP policy keyed to GovRAMP); Arizona (legacy AZ-RAMP consolidation); North Carolina, Nevada, Georgia, Utah, and Oregon (state implementation and oversight of GovRAMP with different scopes and conditions). Kansas, Massachusetts, Michigan, Minnesota and other governments also appear on GovRAMP's participation list, but participation alone does not substantiate a universal statewide certification mandate.
Sources: Utah GovRAMP program; Oregon GovRAMP program; participating government organizations.
There is an especially instructive contrast between Texas and Nevada. Texas allows a qualifying GovRAMP status to support a TX-RAMP certification after review. Its manual even maps GovRAMP Core to TX-RAMP Level 2. Nevada does not accept a TX-RAMP designation as a replacement for its GovRAMP requirements. It also does not treat SOC 2, ISO 27001, or HITRUST as substitutes. The difference is not whether these assessments have any value; it is whether the state's procurement rules recognize them as sufficient evidence.
Georgia provides a more precise example of conditional reciprocity. Its October 2026 standard recognizes eligible FedRAMP authorizations only through a GovRAMP process, with checks for current authorization status, matching system boundary, sufficient evidence, and continuous oversight. A vendor's assertion that it is "FedRAMP aligned" is not enough. Neither are FedRAMP Ready or In Process designations under that Georgia standard.
North Carolina's February policy specifies interim targets of 12 months for Core, 15 months for Ready, and 21 months for Authorized under defined circumstances. Its higher-level adoption page separately states that the general on-ramp ends April 1, 2027. Vendors should not assume a generic grace period overrides the conditions of a newer solicitation.
What cloud compliance costs small businesses and AI vendors
Compliance is a procurement issue, not merely an IT issue. When a state changes its accepted verification path, a vendor may have to account for membership fees, assessment costs, monitoring, the time needed for approval, and the possibility that the product cannot be used with sensitive state data until specified conditions are met.
Those expenses are real. GovRAMP's published lowest membership-tier pricing for companies with less than $1 million in annual revenue lists $2,073 annually for a Single Security Snapshot and $11,733 annually for Core, including GovRAMP dues and program-management fees. Higher verification stages have their own fee structures, and independent assessor costs for Ready and Authorized are additional. Texas, by comparison, says it does not charge a TX-RAMP certification fee, although vendors still bear their own compliance preparation costs.
This can matter especially to smaller software and AI companies selling across multiple jurisdictions. A software platform may be secure and already assessed, but its market-entry decision can hinge on whether an agency recognizes that assessment, what data will be processed, and whether the exact cloud product is covered by the authorization. Buying a service from an authorized cloud infrastructure provider does not automatically authorize an unrelated application built on it.
The scale of the broader harmonization challenge is not merely anecdotal. A July 2026 Government Accountability Office report identified 117 federal cybersecurity regulations, 80 of which contained reporting requirements of types that could overlap with other requirements. That study addressed federal regulations affecting private entities, not a count of redundant state cloud certifications, but it illustrates why cybersecurity leaders are paying attention to overlapping compliance obligations.
Does FedRAMP or GovRAMP reciprocity work across states?
There are signs of progress. The 2026 FedRAMP 20x Class A pathway recognizes a qualifying GovRAMP assessment, SOC 2 Type II, or eligible FedRAMP Rev. 5 assessment completed within the preceding 12 months as an entry prerequisite. That is reuse of existing evidence, not an automatic waiver of the remaining FedRAMP requirements.
FedRAMP granted its first Class A certification in August 2026 and announced the first fully compliant FedRAMP 20x Class C certification on November 2. Meanwhile, GovRAMP's April 2026 framework-harmonization initiative recommended common baselines, reuse of evidence, and more consistent reciprocity. Arizona's decision to replace AZ-RAMP with GovRAMP illustrates that states have practical options for consolidation.
A workable model would let a state recognize verified assessments against shared controls, then require narrowly defined additional safeguards for genuine state-specific risks such as criminal justice information or tax data. States would retain authority to determine risk, without requiring every vendor to start its documentation from zero.
Cloud compliance checklist before responding to an RFP
Is this exact product in scope? Identify the service offering, hosting environment, authorization boundary, and whether state data is stored, processed, or transmitted.
What sensitivity level applies? Public information and restricted tax, health, or criminal justice data can require very different verification statuses.
Which credential is actually accepted? Ask whether the purchasing agency accepts FedRAMP Rev. 5, FedRAMP 20x, GovRAMP, TX-RAMP, or a formal reciprocity process. Do not substitute a company's general SOC 2 report for a required GovRAMP authorization.
What is required at award versus after award? Distinguish contract-entry conditions, monitoring and interim authorization requirements, and the deadline for full verified status.
What is the complete cost of pursuing the market? Budget membership, third-party assessments where required, documentation, remediation, monitoring, and staff time before investing in a state-specific opportunity pipeline.
TX-RAMP provisional certification: 12 or 18 months?
TX-RAMP Program Manual 4.0 says a standard provisional certification is valid for 12 months, while Texas DIR's public FAQ and eligibility page still say 18 months. The manual itself also contains references to an 18-month period when discussing certain other-program pathways. As of this review, DIR's public documents do not present a fully consistent answer. For operational planning, use the more conservative 12-month assumption until DIR confirms the applicable period in writing for your product and certification path.
Bottom line: verify RAMP requirements before bidding
Government cloud security standards are becoming more important in SLED procurement. That should improve protection of public systems and the public's data. Yet the promise of a shared security framework depends on recognition across purchasing authorities, not just a shared list of NIST controls.
For vendors, the practical lesson is simple: verify the security requirements before pursuing a cloud contract, and treat reciprocity as a process to confirm, not a benefit to assume. For states, the policy opportunity is equally clear: require strong, risk-based security while making verified evidence reusable wherever possible.
Frequently asked questions about StateRAMP and state RAMP compliance
Is StateRAMP the same as GovRAMP?
Yes. StateRAMP announced its rebrand to GovRAMP in February 2025. The legal organization remains StateRAMP, doing business as GovRAMP, and existing memberships and verified statuses continued. They are not two separate certifications.
Is GovRAMP certification mandatory in every state?
No. GovRAMP provides shared verification, but each state or public agency establishes its own procurement scope, minimum status and implementation dates. Inclusion in GovRAMP's participation directory does not, by itself, prove a statewide mandate.
What is the difference between FedRAMP and StateRAMP (GovRAMP)?
FedRAMP evaluates cloud offerings for federal use under federal requirements. GovRAMP is a nonprofit public-sector verification framework used by participating state, local, tribal and education organizations. The programs share NIST-based foundations, but their approval, monitoring and recognition rules are not interchangeable.
Does FedRAMP automatically satisfy TX-RAMP or other state requirements?
No. Texas requires a TX-RAMP reciprocity request and DIR validation for qualifying FedRAMP or GovRAMP offerings. Nevada can require FedRAMP-authorized providers to enter GovRAMP Fast Track. Georgia has its own formal verification and reciprocity conditions. Check the state's current procurement documents.
Which states have separate RAMP programs or GovRAMP requirements?
Texas runs a distinct TX-RAMP certification program. Indiana has an Indiana RAMP policy linked to GovRAMP; Arizona is transitioning from legacy AZ-RAMP toward GovRAMP. North Carolina, Nevada, Georgia, Utah and Oregon have published GovRAMP-related policies for specified cloud purchases. This is not an exhaustive list, and not all participating organizations impose statewide mandates.
What do GovRAMP Ready and Authorized mean?
Ready indicates a reviewed readiness level, including an independent assessment, but is not equivalent to full Authorized status. Authorized and Provisionally Authorized involve higher assurance requirements and ongoing oversight. Confirm the product's actual current listing rather than relying on a general vendor claim.
How much does StateRAMP or GovRAMP verification cost?
GovRAMP publishes revenue-based membership and program fees that vary by verification status. Its 2026 lowest published tier included a $2,073 annual Single Security Snapshot and $11,733 annual Core example for companies under $1 million in annual revenue. Independent 3PAO assessments, remediation and internal work may be additional. Recheck the current published fee schedule before budgeting.
Does using a FedRAMP authorized cloud host certify my SaaS application?
No. Security authorization applies to a defined service offering and assessment boundary. Hosting an application on authorized infrastructure does not automatically extend the infrastructure provider's authorization to the application's controls, configuration, operations or data handling.
Primary sources and further reading
North Carolina: GovRAMP adoption and cloud policy supplement
Georgia: Cloud Service Authorization and Monitoring Standard SS-26-003
GAO-26-108606 on potentially overlapping cybersecurity reporting
If you want to add fuel to your government procurement activities, find a time to chat with our team.
