Pass GovRAMP and stay on schedule.
Security engineering, documentation, and evidence for SaaS teams selling to state and local government.
Free 30-minute call. No GovRAMP knowledge needed.
Selling into these states? Expect to be asked about GovRAMP.
Government organizations in 33 states take part in GovRAMP, from state agencies to cities, counties, school districts and universities. Several states already require it, and more state deadlines arrive in 2027.
Status used to be a nice-to-have. When it's written into the contract, it decides who gets to bid. See the state deadlines
- A dated requirement for state contracts
- Government organizations taking part in GovRAMP
States with a dated requirement: Arizona, Georgia, Indiana, Minnesota, Nevada, North Carolina, Texas, Utah. Other states with participating organizations: Alabama, Alaska, Arkansas, California, Colorado, Connecticut, Florida, Idaho, Illinois, Kansas, Maine, Massachusetts, Michigan, Missouri, Nebraska, New Hampshire, New Jersey, New York, North Dakota, Ohio, Oklahoma, Oregon, Vermont, Virginia, West Virginia.
Three routes, three heights.
The higher the peak, the more gets checked before you're listed. GovRAMP's statuses run in order: Core, then Ready, Provisional and Authorized. Many providers start lower down, with Progressing Snapshot.
Routes on this map
Progressing Snapshot
Enroll, get scored by GovRAMP's program office, and appear on the public Progressing Product List, where government buyers look for vendors that are improving. Since January 1, 2026, the score has to rise every quarter. Many providers start here to build readiness for Core.
Our package: Snapshot Score Lift, 4–6 weeks
Core
GovRAMP's own program office checks your evidence for 60 security controls, the specific safeguards it expects, drawn from the federal NIST SP 800-53 Rev. 5 catalog. You don't need an independent assessor. Core products are listed on the Authorized Product List. GovRAMP calls Core a bridge between early progress and full authorization.
Our package: Core Evidence Package, 8–12 weeks to submission
Ready / Authorized
The statuses above Core: Ready, then Provisional and Authorized. Each needs an assessment by an independent assessor, called a third-party assessment organization (3PAO). For GovRAMP's cost and timing figures, see the cost of waiting.
The cost of waiting.
-
Bids you can't make
When a solicitation asks for a GovRAMP status you don't have, you can't respond. Deals that do go ahead can stall in security review.
-
Buyers who pick a listed competitor
A competitor already on the Authorized or Progressing list has answered the security question before your first call.
-
A Snapshot that stalls
Since January 1, 2026, Progressing Snapshot participants must show improvement every quarter. Flat or declining scores trigger an escalation process that can end in removal from the Progressing Product List.
-
A bigger bill later
Remediation on a deadline costs more than remediation on a plan. A contract that needs status fast can push you onto the route that needs an independent assessor, when starting with Core earlier would have cost less. Per GovRAMP, the independent assessor's (3PAO's) costs start around $70,000, and authorization typically takes 6–12 months after engaging one.
-
Gaps that are still there
A listing doesn't patch anything. Weak session handling or a vulnerable dependency is a real risk, whatever your status says.
What we do
-
Gap Assessment
1 week
The starting point. We measure your system against the status your buyers ask for. Credited toward either package.
-
Snapshot Score Lift
4–6 weeks
Raise your score before the next quarterly snapshot, and stay on the Progressing Product List.
-
Core Evidence Package
8–12 weeks
Everything a Core submission needs, from the gap assessment to answering GovRAMP's follow-up questions.
-
AppSec Engineering
Add-on
Hands-on security engineering: secure architecture, cloud security and secure development, plus fixes in your code for authentication, sessions, logging and dependencies.
Have an RFP due? We help you answer the security questions and questionnaires that come with it, including how to describe GovRAMP work that's still in progress.
Experience
Selected experience
Find out where you stand.
A free 30-minute call. You don't need to know anything about GovRAMP first. Bring whatever raised it, like an RFP, a security questionnaire or a buyer's email, and tell us when you need to answer. You'll leave knowing which route fits and what stands in the way.