Questions
Short answers. For the background, read GovRAMP, explained.
Frequently asked questions
Do we need to know GovRAMP before we call?
No. Most teams come to us after a buyer mentions GovRAMP in an RFP, a security questionnaire or an email. Bring whatever you were sent. We'll work out which status you need and what it will take.
What's the difference between Snapshot, Core, and Ready/Authorized?
Progressing Snapshot puts you on the Progressing Product List and, since January 1, 2026, requires your score to improve every quarter. For Core, GovRAMP's own program office (the PMO) checks 60 security controls from NIST SP 800-53 Rev. 5 and lists you on the Authorized Product List. Ready and Authorized need an assessment by an independent assessor, called a 3PAO. The statuses, explained.
Do we need an independent assessor (3PAO) for Core?
No. GovRAMP's program office reviews Core itself, so you don't need a 3PAO assessment.
How long does it take?
The Gap Assessment takes one week. A Snapshot Score Lift takes 4–6 weeks, timed to your next quarterly snapshot. A Core Evidence Package takes most teams 8–12 weeks to submission, and the Gap Assessment sets your actual timeline. GovRAMP's own review time after you submit is outside our control.
What do you need from our team?
Access to the system and the people who run it: your code and infrastructure configuration, an engineer who knows the system, and someone who can make security decisions. How the work splits depends on your team. We can run the project and write the documents, lead your engineers through the technical fixes, make the fixes ourselves, or a mix of these.
Do you write code, or just documents?
Both. We work on the application and its cloud setup, from secure architecture and development to authentication, session management, logging and dependency scanning. Then we write the documentation that describes it.
What does it cost?
Every engagement is scoped to your system. Book the free 30-minute call and we'll scope yours.
Find out where you stand.
A free 30-minute call. You don't need to know anything about GovRAMP first. Bring whatever raised it, like an RFP, a security questionnaire or a buyer's email, and tell us when you need to answer. You'll leave knowing which route fits and what stands in the way.