Primary references
Use the original standards below to check terminology and requirements. These references explain the standards; they do not endorse CISGuard or independently verify its product coverage.
All frameworks
StateRAMP Authorization Support
StateRAMP security requirements,continuously evidenced.
CISGuard maps 50 NIST 800-53 controls underpinning StateRAMP security requirements, giving cloud providers serving state and local government continuous configuration evidence for snapshots, authorization, and ongoing monitoring.
United States (State & Local Government)Cloud Service Providers serving SLED
- Control basis
- NIST SP 800-53 Rev. 5; CISGuard maps 50 controls across 13 families
- Program statuses
- Security Snapshot, Ready, and Authorized (Authorized Product List)
- Who requires it
- Participating state and local governments, via procurement terms
- FedRAMP reciprocity
- Yes; FedRAMP-authorized providers can pursue expedited paths
- Continuous monitoring
- Required after authorization; automated by CISGuard scans
- Deployment
- On-premises or air-gapped; no external dependency required
- Also known as
- GovRAMP (operating name since February 2025)
Overview
What is StateRAMP?
StateRAMP is a nonprofit program that standardizes cloud security verification for state and local governments, modeled on FedRAMP and built on NIST 800-53 Rev. 5 controls. Providers progress through recognized statuses, including early-stage Security Snapshots and Ready and Authorized listings on the program's Authorized Product List, which participating governments consult during procurement. Providers with existing FedRAMP authorization can pursue expedited recognition through reciprocity paths. Like FedRAMP, StateRAMP requires continuous monitoring, not a one-time assessment: providers must demonstrate that controls keep operating after authorization. CISGuard's continuous CIS benchmark scanning, NIST 800-53 mapping, and drift detection produce that technical-control evidence stream for the configuration management, access control, and monitoring families assessors examine most closely. In February 2025 the program announced it now operates as GovRAMP, reflecting its coverage of state, local, tribal, and education entities; StateRAMP remains the legal entity name and existing authorizations continue unchanged.
How CISGuard automates StateRAMP evidence
StateRAMP assessment follows the same shape as FedRAMP: demonstrate NIST 800-53 control implementation, get assessed, then keep proving the controls operate. The recurring cost sits in that last phase, where providers must supply ongoing evidence rather than annual snapshots. CISGuard automates the technical-control portion: continuous CIS benchmark scanning evidences the Configuration Management family, drift detection catches deviations between scans, and the immutable audit trail covers Audit and Accountability. The Framework Coverage Report presents per-control satisfaction status in the NIST 800-53 structure StateRAMP assessors work from. For providers pursuing multiple programs, the same scan data serves FedRAMP, StateRAMP, and TX-RAMP simultaneously, because all three resolve to the same control catalog. CISGuard does not grant StateRAMP status; it produces the evidence your assessment consumes.
Configuration evidence supports an assessment; it does not by itself establish certification, authorization or full compliance. Review coverage boundaries and evaluation evidence.
Control mapping
StateRAMP-relevant NIST 800-53 families CISGuard automates.
Each CIS control is tagged with its framework reference. One scan produces the per-framework coverage report, with satisfied, partially satisfied and not-met status for every control.
| Control area | Controls | Mapped by |
|---|---|---|
| Access Control (AC) | AC-2, AC-3, AC-6, AC-7, AC-11, AC-17 | CIS Account + Identity benchmarks |
| Audit and Accountability (AU) | AU-2, AU-3, AU-6, AU-9, AU-12 | CIS Audit Policy benchmarks |
| Configuration Management (CM) | CM-2, CM-3, CM-6, CM-7, CM-8 | Continuous CIS scanning + drift detection |
| Identification & Authentication (IA) | IA-2, IA-3, IA-4, IA-5, IA-6, IA-8 | CIS Password + MFA + SSO controls |
| Risk Assessment (RA) | RA-5 | Configuration hardening via CIS benchmarks |
| System and Communications Protection (SC) | SC-7, SC-8, SC-13 | CIS Cryptography + Network benchmarks |
| Continuous Assessment (CA) | CA-7 | Continuous CIS posture monitoring |
Auditor evidence
Evidence artifacts CISGuard generates.
Auditor-grade outputs in PDF, HTML, JSON, CSV and SARIF. No spreadsheets, no screenshots, no manual cross-referencing.
- NIST 800-53 Framework Coverage Report aligned to StateRAMP security requirements
- Continuous monitoring evidence stream for post-authorization reporting
- Per-control implementation evidence for third-party assessment review
- Drift detection events documenting configuration change control (CM family)
- Immutable audit trail satisfying AU-2 / AU-3 / AU-12 logging requirements
- Exception register with justification, approval chain, and auto-expiry
Frequently asked
StateRAMP questions, answered directly.
Does CISGuard make my product StateRAMP Authorized?
No, and no software tool can. StateRAMP status is granted through the program's own assessment and approval process, based on independent assessment of your NIST 800-53 implementation. What CISGuard does is produce the continuous technical-control evidence that process consumes: per-control satisfaction status, configuration scan history, drift events, and audit trails, formatted in the 800-53 structure assessors work from.
What is a StateRAMP Security Snapshot and can CISGuard help with it?
A Security Snapshot is StateRAMP's early-stage maturity assessment, giving providers a scored view of their security posture before pursuing Ready or Authorized status. CISGuard helps by establishing the technical baseline first: continuous CIS benchmark scans reveal configuration gaps against hardening standards mapped to NIST 800-53, so you enter the snapshot process knowing your control posture instead of discovering gaps during assessment.
How is StateRAMP different from FedRAMP?
StateRAMP serves state and local government procurement while FedRAMP serves federal agencies. Both build on NIST 800-53, and StateRAMP intentionally mirrors FedRAMP's structure, which is why reciprocity paths exist for FedRAMP-authorized providers. StateRAMP is governed by a nonprofit rather than a federal program office. For CISGuard customers the practical difference is small: the same 50-control NIST 800-53 mapping and continuous monitoring evidence serve both programs.
Does StateRAMP require continuous monitoring like FedRAMP?
Yes. Authorized products must demonstrate ongoing control effectiveness, not just pass a point-in-time assessment. This is where legacy annual-scan tooling fails. CISGuard runs scheduled CIS benchmark scans every 4-24 hours, compares each scan against baseline, and retains posture history across 365 days, producing exactly the continuous evidence stream post-authorization reporting requires.
Can I reuse StateRAMP evidence for TX-RAMP or FedRAMP?
Largely yes, because all three programs resolve to NIST 800-53 controls. Texas DIR accepts StateRAMP and FedRAMP status in its TX-RAMP reciprocity paths, and StateRAMP offers expedited recognition for FedRAMP-authorized providers. CISGuard generates one Framework Coverage Report from one scan dataset, so the same technical evidence supports all three programs without re-collection. Program-specific paperwork and sponsorship still differ.
StateRAMP readiness, on request.
Our compliance engineers have helped organizations achieve regulatory readiness through a seamless, fully managed deployment.