Similar names, but differing purposes. GovRAMP (formerly StateRAMP) and FedRAMP both exist to help government organizations evaluate cloud security through standardized requirements, reusable evidence, independent assessments, and continuous monitoring. However, they serve different buyers and operate under different authorities.
FedRAMP addresses cloud services used by federal agencies, while GovRAMP primarily supports state, local, tribal, educational, and other public-sector organizations. The target customer, data, and procurement requirements determine which applies.
One status isn’t exclusive of the other, and in some cases, both will be needed. Understanding each program's scope, authorization process, terminology, and evidence requirements is essential for cloud service providers and government buyers.
What is FedRAMP?
FedRAMP, the Federal Risk and Authorization Management Program, provides a government-wide approach to evaluating cloud services that process unclassified federal information. Congress codified FedRAMP in law, and the General Services Administration administers it with federal stakeholders.
FedRAMP makes security assessment information reusable across agencies. Providers document their security boundary, control implementation, assessment results, vulnerabilities, and monitoring. Agencies use that evidence for their own risk and authorization decisions.
A FedRAMP designation is not an agency Authority to Operate. Each agency remains responsible for authorizing the service within its information system.
What is GovRAMP?
GovRAMP, Government Risk and Authorization Management Program, is a nonprofit membership organization providing NIST-aligned security verification for public-sector technology. Formerly StateRAMP, it adopted the GovRAMP name in February 2025 to reflect its broader government mission.
GovRAMP reduces inconsistent questionnaires and duplicated vendor reviews. Providers submit common evidence that participating governments can use for risk-based procurement.
GovRAMP Core covers a baseline 60 prioritized NIST controls and receives GovRAMP PMO validation. Ready requires an independent Third-Party Assessment Organization, or 3PAO. Provisionally Authorized and Authorized require comprehensive assessment and approval from a government sponsor or the GovRAMP Approvals Committee.
GovRAMP vs. FedRAMP at a glance
FedRAMP terminology changed in 2026
FedRAMP turned to using “Certification” rather than “Authorization” for its program designation in 2026. The Marketplace describes offerings through a profile consisting of a Type, Path, and Class.
The Type identifies the model, such as 20x or Rev5. The Path distinguishes FedRAMP Program and agency-sponsored routes. Classes A through D describe assessment depth and reporting requirements.
During the transition, the Marketplace displays previous impact levels alongside the new classes, including Class C as the former Moderate designation. New planning and procurement materials should use current terminology.
GovRAMP retains Low, Moderate, and High impact levels and its verification statuses. Its Federal Overlay maps to FedRAMP Rev. 5 to identify overlapping and additional requirements.
Does FedRAMP certification transfer to GovRAMP?
FedRAMP and GovRAMP are each very much their own thing. FedRAMP might carry over some reasonable indicators that GovRAMP certification is more likely, but GovRAMP ultimately makes its own determination.
A provider with a federal authorization, or pursuing one, may qualify for GovRAMP Fast Track. Existing federal documentation can be authenticated and reviewed instead of recreated. This reduces duplication but is not automatic reciprocity.
Likewise, GovRAMP status can provide useful security evidence but does not replace FedRAMP certification for federal use.
Which program should a cloud provider pursue?
Start with the customer and use case. Services processing federal information should evaluate FedRAMP scope and the agency’s required profile. Providers serving states, municipalities, schools, or other public organizations should examine the GovRAMP status requested in procurement documents.
If serving both markets, map requirements before launching parallel projects. Reuse controls, diagrams, policies, assessments, vulnerability reports, and monitoring evidence where permitted. Program-specific review and approval remain necessary.
Buyers should verify the product, deployment model, boundary, status, and monitoring condition—not only the provider’s name. Certification or verification applies only to the evaluated offering and boundary.
How to turn compliance requirements into enforced security
Both programs rely on documented controls, independent evidence, and continued oversight. Security still depends on those controls remaining effective between assessments.
ThreatLocker helps government organizations and service providers enforce Zero Trust controls across applications, privileges, data, endpoints, and network access.
- Application Allowlisting can restrict execution to approved software and scripts.
- Ringfencing™ limits what approved applications can access, launch, and connect to.
- Privileged Access Management removes standing administrator rights and controls elevation.
- Defense Against Configurations can assess technical settings against frameworks, while Unified Audit records policy decisions and activity.
These capabilities support implementation and evidence collection but do not grant GovRAMP verification, FedRAMP certification, or agency authorization.
The ThreatLocker Zero Trust Platform for Government is currently listed on the FedRAMP Marketplace. Buyers should review their existing status and profile during procurement.
Frequently asked questions
Is GovRAMP the same as StateRAMP?
Yes. StateRAMP rebranded as GovRAMP in February 2025. The new name reflects its broader mission across state, local, tribal, educational, and other public-sector communities.
Is GovRAMP mandatory for every state or local government?
No single nationwide rule makes GovRAMP mandatory for every nonfederal government. Requirements depend on the jurisdiction, contract, data, and procurement policy. Providers should review each buyer’s solicitation and security terms.
Does FedRAMP certification satisfy GovRAMP requirements?
Not automatically. Eligible providers can use GovRAMP Fast Track to reuse authenticated federal documentation, but GovRAMP still performs its own review and issues its own status.
Do GovRAMP and FedRAMP require continuous monitoring?
Yes. Both treat security as an ongoing responsibility rather than a one-time assessment. The required cadence, reports, and review process depend on the GovRAMP status or FedRAMP certification profile.
