GovRAMP, explained
The short version, for teams who keep hearing “GovRAMP” on sales calls. You don't need to read it before you talk to us.
What it is
GovRAMP is a nonprofit that verifies the security of cloud products sold to state and local government. Your product earns a status on a public list, so a buyer can check it before they sign.
Why buyers ask for it
It saves them vetting every vendor on their own, and more of them now write it into contracts. Georgia, North Carolina, Indiana, Arizona and Utah already require it for state contracts, and government organizations in many more states take part, from cities and counties to school districts and universities.
If a solicitation names a status you don't have, you usually can't bid.
The statuses
Think of them as steps up the same mountain. The higher you go, the more gets checked.
Progressing Snapshot
The on-ramp. GovRAMP scores your security every quarter and lists you publicly while the score goes up. Buyers can find you there, and you can point to it in a bid. If the score stalls, you can be removed.
Our package: Snapshot Score Lift, 4–6 weeks
Core
A verified status. GovRAMP itself checks 60 core security controls, with no outside assessor. Several states now ask for it on state contracts.
Our package: Core Evidence Package, 8–12 weeks to submission
Ready and Authorized
The higher steps. An outside assessor (a 3PAO) tests your system, which takes longer and costs more. Buyers tend to ask for these when you'll handle sensitive data.
Which fits you
- A contract names Core. Aim for Core.
- You need to show up on GovRAMP's list now. Start with Progressing Snapshot and raise your score each quarter.
- You sell to Texas state agencies or universities. Texas runs its own program, TX-RAMP. Any verified GovRAMP status qualifies, and Snapshot enrollment gets you provisional certification.
- You'll handle sensitive data, or a buyer asks for Ready or Authorized. You'll need an outside assessor.
- Not sure? That's what the free call is for.
Find out where you stand.
A free 30-minute call. You don't need to know anything about GovRAMP first. Bring whatever raised it, like an RFP, a security questionnaire or a buyer's email, and tell us when you need to answer. You'll leave knowing which route fits and what stands in the way.