• StateRAMP 3PAO advisory and assessment services

Take a standardized, proven approach to StateRAMP authorization.

Contact an expert

Gain access to new state and local government agency revenue streams by leveraging our expert advisory and assessment services to achieve StateRAMP authorization.

Applying extensive FedRAMP expertise to the StateRAMP process

StateRAMP is heavily modeled after FedRAMP, where we are the number-one player across assessment and advisory clients. We bring this unique experience and perspective to all StateRAMP engagements.

StateRAMP assessment solutions

Through our structured assessment methodology, we provide a clear timeline for specific authorization milestones – enabling your organization to accurately forecast when authorization will be achieved. Our approach to helping you assess your readiness for StateRAMP Authority to Operate (ATO) comprises three activity groups: readiness, initial, and annual assessment.

StateRAMP readiness
  • An in-depth review of the authorization boundary to ensure all external services, interconnections, and data flows are represented
  • Validation of StateRAMP mandates and requirements as well as defining capability information within the readiness assessment report (RAR) template
  • A detailed executive summary highlighting notable strengths and weaknesses, control implementations, and maturity of the information system
StateRAMP initial assessment
  • Security assessment plan (SAP) that captures how we will perform the assessment and when key milestones will be completed
  • Technical interviews to validate control implementations
  • Identification of any risks through manual control testing, vulnerability scanning, and penetration testing
  • A comprehensive security assessment report (SAR) detailing any risks identified, how they impact the information system, and what remediation activities are needed to reduce risk
  • Support throughout the sponsor package review process to provide clarity on testing activity, remediation activities, and insights on gaps noted from the reviewer
StateRAMP annual assessment
  • Assistance with preparation for the annual assessment prior to the ATO deadline
  • Continuous monitoring for any StateRAMP-authorized product
  • Assessment of one-third of your security controls plus any additional controls required by the StateRAMP Program Management Office or State Authorizing Body
  • All testing activities that were covered within the initial assessment
StateRAMP assessment graphic

StateRAMP advisory solutions

Our approach to helping you achieve and maintain StateRAMP ATO comprises three activities: gap analysis, readiness preparation, and documentation development.

 

Gap analysis
  • Introduction to the StateRAMP program
  • Anticipated timeline for pursuing StateRAMP authorization
  • In-depth information-gathering session with stakeholders to learn about organizational structure, information systems, StateRAMP control implementation status, overall compliance posture, and any other concerns regarding position
  • Data analysis to understand the implementation status of each security control and appropriately identify control deficiencies
Readiness preparation
  • Expert-led discussion on StateRAMP Ready minimum mandates and required documentation
  • Stakeholder review of:
    • Information system security boundary updates and outstanding gaps
    • StateRAMP control baseline-related questions to determine whether systems meet requirements

Using an iterative, collaborative process, the necessary readiness documentation – including the StateRAMP Controls Matrix (implementations) and StateRAMP System Security Plan Template – is finalized in preparation for the readiness assessment.

Documentation development

After receiving your feedback on the initial draft, we make revisions and conduct quality assurance to deliver a final draft of these documents:

  • Information security policies
  • Data questionnaire
  • Privacy threshold analysis and privacy impact analysis
  • System security plan and controls matrix
  • Rules of behavior
  • IT contingency plan
  • Configuration management plan
  • Incident response plan
  • Continuous monitoring plan
StateRAMP advisory graphic

“Since StateRAMP’s inception, Coalfire has provided invaluable information...

...insight, thought leadership, and guidance to help build the framework to make StateRAMP a reality. We at StateRAMP are proud of our partnership with Coalfire and look forward to many years of collaboration.”

Leah McGrath executive director, StateRAMP

What can you expect from our StateRAMP services?

Industry leaders

We’re one of the first Third Party Assessment Organizations to receive StateRAMP accreditation and have more clients listed on the StateRAMP Authorized Vendor list than any other 3PAO.

Compliance Essentials

By coordinating assessments across more than 50 compliance frameworks, you can eliminate duplicate activities and maintain a state of continuous compliance with Compliance Essentials.

100% track record

Every system that has been submitted for StateRAMP authorization has been approved.

StateRAMP pioneers

We helped develop the StateRAMP program, serving on both the Steering and Standards & Technical Committees.

The most experience

More than 60% of current StateRAMP-Ready systems used Coalfire – more than any other 3PAO.

Frequently asked questions about StateRAMP and FedRAMP

StateRAMP versus FedRAMP: How are they similar?
  • Both are based on NIST SP 800-53.
  • Both use "Ready" and "Authorized" statuses.
  • Both require 3PAO audits.
  • Both rate impact levels using "low," "moderate," and "high," which align with NIST.
StateRAMP versus FedRAMP: How are they different
  • StateRAMP is a resource for state and local governments, while FedRAMP operates on the federal level.
  • StateRAMP is tailored to the unique needs of each state, while FedRAMP promotes cloud security federally.
  • Unlike FedRAMP, which is a paid government resource, StateRAMP is a nonprofit that encourages cybersecurity best practices via education.
  • StateRAMP Ready statuses do not have an expiration date, while FedRAMP has a 12-month window to become Authorized once Ready status is achieved.
  • StateRAMP allows state and local governments to monitor their vendors' security. FedRAMP monitoring is only offered to federal agencies.

We’re here to support your StateRAMP journey and are always available to answer your questions.

Related resources

StateRAMP assessment services

data sheet StateRAMP assessment services

Demystifying FedRAMP and StateRAMP

webinar Demystifying FedRAMP and StateRAMP

At the Forefront: StateRAMP Advisory

webinar At the Forefront: StateRAMP Advisory

The race to StateRAMP: Government raises the bar for cloud services

white paper The race to StateRAMP: Government raises the bar for cloud services

Ready to fuel your success with unmatched cybersecurity solutions?

Secure your business’s future with our technical expertise, innovative technology, and compliance consulting.

Close