StateRAMP takes several of its requirements from FedRAMP, and perhaps one of the most important requirements is continuous monitoring. Continuous monitoring ensures that systems that earned StateRAMP Authorization remain in compliance year after year, avoiding gaps in security and protecting the interest of state and local governments.
StateRAMP is now nearly two years old, and the small project is quickly becoming a mainstay in the security industry. State and local governments are looking for a solid cybersecurity framework that they can use to vet and certify cloud providers that they may work with.
In this article, we’ll talk about the basics of StateRAMP, specifically the Security Assessment Framework, and the processes and documents required therein.
One of the earliest tasks that Cloud Service Providers, 3PAOs, and state agencies complete are determining the security levels required to protect data in a cloud environment. FedRAMP uses federal standards and documentation to outline Impact Levels based on the importance of the data. StateRAMP follows suit by defining Impact Categories based on FedRAMP.