StateRAMP vs. FedRAMP: Security Testing Requirements Compared

Key Takeaways

• Your audience decides the answer: FedRAMP is required for federal cloud work. StateRAMP, now GovRAMP, serves state, local, tribal, and education (SLTT) organizations. Both rest on NIST SP 800-53.
• Both programs test hard: Each one calls for monthly vulnerability scans, penetration testing, continuous monitoring, and an annual review by a third-party assessment organization (3PAO). FedRAMP sets the tighter and more exact bar. That gap is widest at the High impact level.
• The right framework shapes your business: Chasing federal contracts? FedRAMP is not optional. Selling to state and local government? GovRAMP is faster and cheaper to reach, and it works as an on-ramp to FedRAMP later.

Do you sell cloud technology to government agencies? Then one question shapes your roadmap. Which security authorization do you actually need?

The answer turns on which level of government you serve. Security testing requirements can decide whether you win a contract. They can also get you cut before the review even starts.

Two frameworks matter most for cloud service providers (CSPs) that sell to government clients. The first is FedRAMP, the Federal Risk and Authorization Management Program. The second is StateRAMP, renamed GovRAMP in February 2025.

At a glance the two look alike. Both build on NIST SP 800-53 controls. Both require third-party assessments and continuous monitoring.

The details differ, though. Security testing is where the gap shows. Those gaps hit your budget, your timeline, and your strategy.

This StateRAMP vs. FedRAMP guide compares the security testing requirements of each program. You will see what each one asks for, where the two split, and how to pick your path.

What Are FedRAMP and StateRAMP (GovRAMP)?

FedRAMP: The Federal Gold Standard

The General Services Administration (GSA) set up FedRAMP in 2011. The goal was one standard, repeatable way for the federal government to judge cloud security.

The core idea is simple: "do once, use many." A CSP goes through the process once. Any federal agency can then reuse that package instead of repeating the same audit.

Federal agencies cannot opt out. The FedRAMP Authorization Act was signed as part of the FY23 National Defense Authorization Act. It makes FedRAMP the required approach to cloud security assessment and authorization.

That rule covers every executive agency cloud deployment and service model. It applies at the Low, Moderate, and High impact levels.

Want to sell cloud services to the federal government? You need FedRAMP authorization.

The process is deep and slow. Plan for 12 to 18 months and a budget that can top $1 million. That price tag reflects the volume of paperwork, testing, and fixes involved.

StateRAMP / GovRAMP: FedRAMP for the States

StateRAMP began in 2020 to close a clear gap. The federal government had FedRAMP, but state and local governments had to judge cloud vendors on their own. Reviews were split, uneven, and costly.

State leaders, IT pros, and former FedRAMP officials teamed up to fix it. The result was StateRAMP, formally renamed GovRAMP in February 2025. The new name reflects a wider mission: a "whole-of-state" approach to cybersecurity.

GovRAMP runs as a 501(c)(6) nonprofit, governed by a board of directors. It has no tie to the federal government. Even so, it mirrors FedRAMP's structure and NIST 800-53 base on purpose, which gives vendors and government buyers a familiar path.

GovRAMP serves SLTT organizations. If the state and local market is your focus, it offers a faster and cheaper route than FedRAMP. You still get credible, third-party verified proof of security.

‍

The Security Foundation: NIST SP 800-53

Both programs start from one source: NIST Special Publication 800-53. It holds the full catalog of security and privacy controls used to protect federal information systems and organizations.

FedRAMP and GovRAMP both apply NIST 800-53 as their baseline. Today both sit on Revision 4 and are moving to Revision 5. That shared base matters.

Firms that already run NIST-based controls start well ahead on either path. The shared base also lets the two programs work together.

NIST 800-53 spans 20 control families. They cover Access Control, Audit and Accountability, System and Communications Protection, Incident Response, and more.

FedRAMP and GovRAMP each map that catalog to cloud systems. Each one sets which controls apply at each impact level. Each one also sets how you run and test them.

‍

Impact Levels: Low, Moderate, and High

Both programs sort cloud systems into impact levels. That sorting drives the depth and cost of your security testing. Each level maps to the harm that would follow if data lost its confidentiality, integrity, or availability.

FedRAMP Impact Levels

• Low: For systems where a breach would do limited harm. Requires 125 controls.
• Moderate: The most common level. It covers systems where a breach would do serious harm. Requires 325+ controls, and it is the usual baseline for cloud services sold to the federal government.
• High: The strictest level. It is reserved for sensitive unclassified data in law enforcement, emergency services, financial systems, and health systems. Requires 421+ controls and far heavier testing.

‍

GovRAMP (StateRAMP) Impact Levels

GovRAMP offers Low and Moderate impact levels. It does not offer a High baseline.

Does your cloud system handle data that would rate High? Then it goes to FedRAMP instead.

That is one of the clearest splits between the two programs. GovRAMP is built for the normal range of state and local data. It is not built for the most sensitive federal data.

Most firms in the SLTT market should aim at the Moderate impact level. GovRAMP's Moderate baseline lines up closely with FedRAMP Moderate, though not exactly.

‍

Security Testing Requirements: A Deep Dive

Here is the detail your security and compliance teams care about most. Both FedRAMP and GovRAMP stack four layers of security testing.

• Vulnerability scanning.
• Penetration testing.
• Configuration scanning.
• Independent third-party assessment.

Here is how each layer breaks down.

1. Third-Party Assessment Organizations (3PAOs)

Both programs require accredited third-party assessment organizations (3PAOs) to run the security assessment. These are outside auditors. They give objective proof that a CSP's cloud system meets the controls that apply.

FedRAMP: A 3PAO must hold accreditation from the American Association for Lab Accreditation (A2LA). It must also be listed on the FedRAMP marketplace.

A FedRAMP-certified 3PAO that runs penetration tests needs more. It must hold industry-recognized pen testing credentials. R311 spells that out.

FedRAMP's Joint Authorization Board (JAB) process, dropped in 2024, once required a 3PAO. Today, under Agency Authorization, a 3PAO is strongly advised. It is all but required for a marketplace listing.

GovRAMP (StateRAMP): A 3PAO must be designated by A2LA and listed on the GovRAMP Marketplace. GovRAMP-authorized providers must use a GovRAMP-approved 3PAO for annual assessments. They must also use one to judge the impact of major system changes.

The 3PAO sits at the center of both initial authorization and ongoing continuous monitoring.

2. Vulnerability Scanning

Vulnerability scanning is the cornerstone of continuous monitoring in both programs. It is the regular, automated hunt for weak spots across your cloud system. That covers servers, databases, web apps, and network parts.

Frequency: FedRAMP and GovRAMP both require vulnerability scans at least once per month. That floor is not open to debate. Both expect steady, automated scans that keep an accurate picture of your posture at all times.

Scope of scanning tools: Under both programs, providers must run tools that cover every part of the system.

• Operating system and network vulnerability scanners.
• Database vulnerability scanners.
• Web application scanners.
• Container scanners, which matter more and more in modern cloud builds.

‍

FedRAMP-specific requirements: FedRAMP is very exact about scan quality. About 60 to 90 days before a Security Assessment Report (SAR), give your 3PAO recent scan data in a machine-readable format. Ideally that data covers the last three months.

Scans must run with authenticated credentials at the highest privilege you have. Every vulnerability plugin must be on, and you cannot switch some off to hide findings. Miss any of these marks and the 3PAO will flag it, which can trigger extra checks.

GovRAMP-specific requirements: GovRAMP's Vulnerability Scan Requirements Guide (Version 1.0) sets the format. Send raw scan data to the GovRAMP Program Management Office (PMO) in CSV or Excel. Send summary reports in PDF or Word.

Every summary report must hold three parts.

• An Executive Summary.
• A Detailed Summary.
• An Inventory Report.

‍

You must also file a current and accurate system inventory. It has to name every part inside the authorization boundary. During the assessment, your first scans must be run or validated by the designated 3PAO.

Both programs enforce these rules. Do your vulnerability scans fall short on quality or arrive late? The PMO can order an immediate rescan, demand a corrective action plan, or pull your authorization status.

3. Penetration Testing

Vulnerability scanning finds known weak spots on its own. Penetration testing goes further, because skilled pros try to exploit those weak spots for real. That shows the true impact of a breach.

Both programs require penetration testing. Both align with NIST SP 800-115 methodology.

FedRAMP Penetration Testing Requirements

FedRAMP is the most exact of any government cloud program here. A CSP must run a penetration test no earlier than six months before its initial authorization date. After that, a test is due once every 12 months during the continuous monitoring phase.

An accredited FedRAMP 3PAO must do the work. Any other skilled security firm will not count.

The Three FedRAMP Threat Models

FedRAMP names three threat model types for penetration testing.

• Enterprise: Covers recon, privilege escalation, infiltration and exfiltration, detection evasion, and persistence inside the system.
• Mobile: Covers the same attack types as Enterprise. It adds flaws tied to mobile devices, tablets, remote workstations, and internet of things (IoT) systems.
• Web Application: Targets web-facing apps and services inside the cloud system.

‍

The Six FedRAMP Attack Vectors

FedRAMP also names six attack vectors that penetration testing must include. The only excuse is a vector that is clearly out of scope for the system.

• External to Corporate: Social engineering and phishing aimed at the CSP itself. The 3PAO must document phishing email templates and seek approval for them.
• External to CSP Target System: Attacks on the cloud system from the internet. This is the classic "hacking" case.
• Tenant to CSP Management System: Tests whether a tenant can break into the CSP's own management setup.
• Tenant to Tenant: In multi-tenant setups, tests whether one tenant can compromise another. That is a key worry for shared cloud infrastructure.
• Mobile App to Target System: Where mobile apps exist, tests attacks launched from mobile devices and operating systems.
• Client-Side Applications or Agents to Target System: Covers hybrid or locally-installed parts. Tests those parts and their links to cloud services.

‍

Every finding goes into the SAR. That report joins the System Security Plan (SSP) and the Plan of Action & Milestones (POA&M). Together they give the authorizing official the evidence for a risk-informed call.

GovRAMP Penetration Testing Requirements

GovRAMP tracks FedRAMP's method closely. It also leans on NIST SP 800-115 as its framework. A GovRAMP-approved 3PAO must run an annual penetration test as part of continuous monitoring.

GovRAMP is widely seen as easier to reach than FedRAMP, above all at the start. The rules still have teeth. Core expectations for scope, method notes, and findings reports mirror FedRAMP.

4. Configuration Scanning

Both programs also require regular configuration scanning. That means checking servers, switches, network devices, and cloud parts against approved security baselines.

Configuration drift is the slow change of settings over time. It is a real and often missed risk in cloud systems. Both programs treat configuration scanning as an ongoing duty, not a one-time task.

Configuration scan results feed your continuous monitoring posture. Assessors review them during annual assessments.

5. Annual Third-Party Assessments

Once a CSP wins approval, both programs require an annual assessment by an approved 3PAO. That check confirms two things. Your security posture has held up, and any major system change has been properly reviewed.

FedRAMP: Annual assessments cover a full control review, vulnerability scanning validation, penetration testing, and a paperwork review. The cycle also reviews monthly scan data, POA&M updates, and incident reports. CSPs must send monthly vulnerability scanning reports to their sponsoring agency or to the FedRAMP PMO.

GovRAMP: Annual assessments follow a similar shape. GovRAMP asks CSPs for monthly, quarterly, and annual reports that show steady compliance.

One key difference stands out. GovRAMP gives state and local governments a view into continuous monitoring reports and their vendors' security postures. FedRAMP does not, because its files are visible only to the federal agencies working with the provider.

Authorization Paths: How You Get There

The security testing requirements are only half the picture. You also need to know how you move through the process itself.

FedRAMP Authorization

In 2024, FedRAMP dropped the JAB pathway. Agency Authorization is now the main route.

Under it, a CSP must find a federal agency willing to sponsor its cloud service offering. The CSP and that agency then work together toward an Authority to Operate (ATO).

The Agency Authorization path has several key phases.

• Partnership and readiness assessment with a federal agency sponsor.
• FedRAMP Readiness Assessment, which is optional but wise. This early 3PAO review produces a Readiness Assessment Report (RAR).
• Full assessment by an accredited 3PAO. It covers vulnerability scanning, penetration testing, and control notes.
• Agency review and issue of the ATO.
• Listing on the FedRAMP Marketplace, so other agencies can reuse the ATO.

‍

Finding that federal sponsor before you start is one of the hardest parts of FedRAMP. Smaller and newer cloud providers feel it most.

GovRAMP Authorization

GovRAMP's process mirrors FedRAMP's, with a few useful breaks.

• No sponsor required: Unlike FedRAMP, GovRAMP CSPs can seek approval with no government sponsor. The GovRAMP Approvals Committee can act as the sponsoring body instead. Five government members sit on it, and it covers Provisionally Authorized and Authorized statuses.
• Ready status does not expire: FedRAMP gives CSPs 12 months to find an agency sponsor after Ready status. Then it expires. GovRAMP's Ready status does not expire, so vendors get more room.
• Fast Track for FedRAMP-ready providers: Do you already hold FedRAMP Ready status? Then you can use the GovRAMP Fast Track program and skip the full audit. That can cut the time to GovRAMP approval from months to weeks.
• No contract required for status: You can hold GovRAMP status with no active government contract. That is a real edge over FedRAMP.

‍

Cost and Timeline Realities

For most firms weighing the spend, cost and timeline decide the matter.

FedRAMP asks a lot. The process usually spans 12 to 18 months. It can cost upward of $500,000 to $1 million or more.

The final number turns on three things.

• How complex your system is.
• How many controls you must write up.
• What your 3PAO charges.

‍

Continuous monitoring then adds recurring cost: monthly scans, annual assessments, and regular reports.

GovRAMP costs less. The program is simpler, and state and local rules are often less complex. Initial authorization usually takes 6 to 12 months, and ongoing costs run lower too.

For small and mid-sized cloud service providers, GovRAMP can be a stepping stone. It builds the program and the paperwork habits FedRAMP will later demand.

Neither program is a box-ticking exercise, though. Both are real security investments. Both have real effects on your engineering, security, and compliance teams.

‍

Continuous Monitoring: The Ongoing Obligation

Here is the point firms miss most. Approval is not a finish line. It is the start of an ongoing compliance duty.

Continuous monitoring is the steady review of your security posture after authorization. It includes the tasks below.

• Monthly vulnerability scanning and reporting.
• Ongoing POA&M management, which tracks each flaw, its fix status, and its timeline.
• Annual third-party assessments by an accredited 3PAO.
• Incident reports filed within set timeframes.
• Change control, so major system changes get a security review before they go live.

‍

FedRAMP requires CSPs to send monthly vulnerability scanning reports to their sponsoring agency. Those reports cover operating system, database, and web application scans. They must show active work on the findings.

FedRAMP also sets fix deadlines by severity. Critical findings get the shortest windows, and lower-severity findings get longer ones. All of them must be tracked.

GovRAMP lines up closely with FedRAMP here, with one clear plus. GovRAMP gives state and local agencies direct sight of their vendors' continuous monitoring data and posture reports. That openness is built into the design, and it supports the "whole-of-state" mission.

It also lets government clients watch the health of the cloud services they use. That helps state IT and security teams who lack the staff to run their own assessments.

‍

Which Framework Is Right for Your Business?

The honest answer: it depends on where your customers are.

Choose FedRAMP if: You sell to federal agencies. Full stop. FedRAMP is required, not optional, for cloud services used by the executive branch.

Even if you also serve state and local clients, federal revenue means you need FedRAMP authorization.

Choose GovRAMP if: Your main market is SLTT clients. GovRAMP gives you a credible, standard security authorization. It meets the buying rules of the governments that have adopted the program, and that list keeps growing.

If federal clients are not on your map, GovRAMP is the direct route to SLTT government business.

Consider both if: You serve, or want to serve, government clients at more than one level. The good news is that the two programs are built to work together.

Already FedRAMP authorized? Fast Track makes GovRAMP much quicker. Start with GovRAMP instead, and the program and notes you build cut the cost of FedRAMP later.

One thing is clear from both programs. The work they demand builds real security maturity, from third-party assessment to vulnerability scanning and penetration testing. These are not paper drills, and run well they produce cloud systems that are truly safer.

‍

Where Essendis Fits In

You should not tackle FedRAMP or GovRAMP alone. The paperwork load is heavy, the assessments run deep, and continuous monitoring never stops.

All of it calls for special skill. That is doubly true if your team's energy belongs on your core product, not on a compliance program.

Our team at Essendis includes former Big Four auditors and seasoned cybersecurity advisory professionals. We turn dense security rules into plans you can act on.

Maybe you need the gap analysis that comes before you start. Maybe you are prepping for a 3PAO assessment. Maybe you need help with the ongoing vulnerability scanning and monitoring that FedRAMP or GovRAMP authorization brings.

Essendis gives you the advisory and engineering depth to keep your program on track. We also offer managed cybersecurity services that watch your network and endpoints. Those services support the continuous monitoring both programs demand.

Weighing a cloud migration or assessment as part of your compliance readiness? Our cloud engineering team can shape your setup for speed and compliance from day one.

FedRAMP and GovRAMP are demanding by design. The agencies that rely on these certifications trust that the cloud services they use are truly secure. The depth of the testing requirements reflects that trust.

Work with a team that knows both the letter and the spirit of these programs. That is the fastest way to earn approval and the surest way to keep it.

Frequently Asked Questions

What is the main difference between FedRAMP and StateRAMP?

FedRAMP is a required federal program. It applies to cloud services used by U.S. federal agencies.

StateRAMP, now renamed GovRAMP, is run by a nonprofit and modeled on FedRAMP. It applies to cloud services used by SLTT organizations.

Both are built on NIST SP 800-53. Both require third-party assessments. FedRAMP is far more exact and takes far more time and money.

Does StateRAMP (GovRAMP) accept FedRAMP authorization?

Yes. GovRAMP runs a Fast Track program for cloud service providers that already hold FedRAMP Ready status. Fast Track lets them skip the full GovRAMP audit.

That cuts the time to approval from months to weeks. If you are already FedRAMP authorized, GovRAMP is much lighter work.

How often do I need to conduct penetration testing under FedRAMP?

FedRAMP requires penetration testing no earlier than six months before the initial authorization date. After that, you test once a year as part of continuous monitoring.

An accredited FedRAMP 3PAO must run the test. It must cover FedRAMP's six mandated attack vectors. The one excuse is a vector that is clearly out of scope for your system.

What is a 3PAO and why is it required?

A third-party assessment organization (3PAO) is an outside security auditor. A2LA accredits it. FedRAMP and GovRAMP both require a 3PAO to perform or oversee the security assessment.

That work covers vulnerability scanning validation, penetration testing, and control reviews. The 3PAO gives independent proof that the cloud system meets the controls that apply. That proof is the basis for the authorization decision.

Can StateRAMP (GovRAMP) lead to FedRAMP authorization?

Indirectly, yes. GovRAMP approval builds the program maturity, paperwork habits, and continuous monitoring setup that FedRAMP requires.

Many firms use GovRAMP as a stepping stone. They win the state and local market first, then build toward FedRAMP's tougher bar. The two programs are designed to work together, so effort in one pays off in the other.

What happens if I miss a monthly vulnerability scan under either program?

Both programs enforce missed or weak vulnerability scans. The PMO can order an immediate rescan, demand a corrective action plan, or pull your authorization status.

Losing that status hits the business directly. Your marketplace listing suffers, and government clients may have to stop using your service. Reliable, documented scans are essential.

Is GovRAMP mandatory for state government vendors?

No. GovRAMP is a voluntary program, though adoption is growing. More state and local governments now make GovRAMP approval a condition of purchase for cloud services.

Each state sets its own policy, so rules vary. Watch the buying rules of your target government clients to stay ahead.

How does Essendis help with FedRAMP or GovRAMP compliance?

Essendis provides cybersecurity advisory services that guide cloud service providers through both FedRAMP and GovRAMP authorization. That work covers gap analysis, security control setup, 3PAO assessment prep, and ongoing continuous monitoring support.

Our team includes former Big Four auditors with deep experience in government security frameworks. Contact us to talk through where you are in the compliance journey and how we can help.

‍