Requirements & evidence
GovRAMP (formerly StateRAMP)
A standardized assessment, authorization, and continuous-monitoring program for cloud services used by state and local governments, built on NIST SP 800-53 Rev. 5. Core, Ready, and Authorized are service-offering statuses—not company-wide certifications. StateRAMP rebranded to GovRAMP on 2025-02-14; StateRAMP, Inc. remains the legal entity operating under the GovRAMP name.
- Edition on record
- Rev. 5 baselines
- Issuing authority
- GovRAMP (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for cloud services, SaaS, state and local government, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Low, Moderate, and High baselines
- Core 60-control subset
- Third-party assessment
- Authorization sponsorship
- Continuous monitoring
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
Confirm current GovRAMP template and control-parameter reuse terms before importing program material; verified statuses require the applicable PMO, sponsor, and/or 3PAO process.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
GovRAMP (formerly StateRAMP) is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; no GovRAMP baseline or overlay is ingested and no ControlFrame service offering holds a GovRAMP status.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 28, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- Rev. 5 baselinesCurrent edition on record · Replaces Rev. 4 baselines
- Rev. 4 baselinesSuperseded editionPublication date not recorded
Recorded change history
· GovRAMP (formerly StateRAMP) Rev. 5 baselines supersedes Rev. 4 baselines and is the current edition.
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 28, 2026.
- GovRAMP (opens in a new tab)
Issuing authority and framework publication.
- Edition reference: Rev. 5 baselines (opens in a new tab)
The publication used to establish the recorded edition.
Catalog provenance and record details
Framework record: govramp-rev5.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Low, Moderate, and High baselines · Core 60-control subset · Third-party assessment · Authorization sponsorship · Continuous monitoring.
Record last updated: August 28, 2026.
Common questions
A closer look.
What is GovRAMP (formerly StateRAMP)?
A standardized assessment, authorization, and continuous-monitoring program for cloud services used by state and local governments, built on NIST SP 800-53 Rev. 5. Core, Ready, and Authorized are service-offering statuses—not company-wide certifications. StateRAMP rebranded to GovRAMP on 2025-02-14; StateRAMP, Inc. remains the legal entity operating under the GovRAMP name.
Who does GovRAMP (formerly StateRAMP) apply to?
GovRAMP (formerly StateRAMP) applies to cloud services, SaaS, state and local government, US, per GovRAMP.
What is the current version of GovRAMP (formerly StateRAMP)?
The current edition is Rev. 5 baselines, issued by GovRAMP and published 2024-10-01. Source: https://govramp.org/document-library.
What does an assessment under GovRAMP (formerly StateRAMP) require?
No control catalog has been ingested for GovRAMP (formerly StateRAMP) yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
GovRAMP (formerly StateRAMP)
Rev. 5 baselines
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize GovRAMP (formerly StateRAMP) requirements, evidence preparation, and review for your assessment scope.