Control evidence once
Evidence mapped to NIST SP 800-53 Rev. 5 controls and reused across GovRAMP and FedRAMP.
Platform →- Home
- GovRAMP
GovRAMP verification, current every month
GovRAMP, formerly StateRAMP, verifies the security of cloud products that state, local, tribal and territorial governments buy, using NIST SP 800-53 Rev. 5. NISTcompliance.ai keeps your control evidence, 3PAO assessment history and monthly continuous monitoring in one record, and reuses the evidence you already keep for FedRAMP.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
What NISTcompliance.ai does
One record for GovRAMP and FedRAMP
Continuous monitoring
Monthly scan results, POA&M updates and the executive summary GovRAMP expects, from one record.
Continuous monitoring →Assessor workspace
Evidence and history your 3PAO can trace for readiness and annual testing.
Assessor workspace →Managed remediation
Engineers who help close findings inside the 30, 90 and 180 day windows.
Managed remediation →Feb 14, 2025StateRAMP announced its move to the GovRAMP name
Rev. 5NIST SP 800-53 basis
Low to HighImpact levels in SAF v4.2
60Prioritized controls in GovRAMP Core
Sources: GovRAMP announcement, GovRAMP FAQs, GovRAMP update, Dec 2025, GovRAMP security program. Sources checked Oct 23, 2026. Not a substitute for the official text.
Statuses
Four statuses, four levels of proof
Swipe to see every column
| Status | What it shows | Who assesses |
|---|---|---|
| Core | 60 prioritized controls aligned to the NIST SP 800-53 Rev. 5 Moderate baseline | GovRAMP program office; no 3PAO required |
| Ready | Meets GovRAMP's minimum mandatory requirements and most critical controls | 3PAO Readiness Assessment Report |
| Provisionally Authorized | Meets Authorized requirements with limited identified deficiencies tracked on a POA&M | 3PAO assessment, program office review and a Sponsoring Body decision |
| Authorized | Full baseline for the impact level | 3PAO Security Assessment Report plus approval from the sponsoring body |
Sources: Security Assessment Framework v4.2, GovRAMP security program. GovRAMP also offers Security Snapshot and a Progressing Security Snapshot program. Sources checked Oct 23, 2026. Not a substitute for the official text.
Fast Track
How FedRAMP status carries over
SAF 1.8.1FACT
No new audit
Fast Track requires no new audit for products with a FedRAMP Ready, ATO or P-ATO status.
FAST TRACKFACT
What you submit
Your SAR or RAR, 90 days of continuous monitoring data and any required GovRAMP templates. You must be an active GovRAMP member.
SAF 1.8GUIDANCE
Terminology lag
GovRAMP's Fast Track text still refers to FedRAMP Ready, ATO and P-ATO. FedRAMP's 2026 rules now use the term Certification.
Sources: Security Assessment Framework v4.2, Fast Track. Sources checked Oct 23, 2026. Not a substitute for the official text.
Continuous monitoring
What GovRAMP expects every month and year
SAF 1.7.1FACT
Monthly package
A monthly executive summary and an updated POA&M.
SAF 1.7.2FACT
Monthly scans
Vulnerability scanning of your information systems at least monthly.
SAF 1.7.1FACT
Annual 3PAO testing
An approved 3PAO assesses roughly one-third of the security controls each year.
GOVRAMP FAQFACT
Remediation windows
POA&M items are remediated within 30, 90 or 180 days for high, moderate and low findings.
Sources: Security Assessment Framework v4.2, GovRAMP FAQs. Sources checked Oct 23, 2026. Not a substitute for the official text.
Questions
Common questions
Is GovRAMP the same organization as StateRAMP?
Yes. StateRAMP announced its rebrand to GovRAMP on Feb 14, 2025. The legal entity remains StateRAMP, doing business as GovRAMP.
Which impact levels does GovRAMP use?
Low, Moderate and High, each based on the matching FedRAMP Rev. 5 baseline.
Does GovRAMP accept FedRAMP 20x?
As of its December 2025 update, GovRAMP was exploring a pathway for providers pursuing both FedRAMP 20x and GovRAMP. None is published in SAF v4.2.
Does Fast Track cost less?
GovRAMP states that Fast Track fees are the same as the standard process. The savings come from reusing your federal assessment documentation.
Book a demo
Keep GovRAMP current
We will map your evidence to the GovRAMP status you are pursuing.