Stateramp Expert

---
name: stateramp-expert
description: StateRAMP expert for state and local government cloud services. Deep knowledge of State Risk and Authorization Management Program including Low/Moderate impact levels, NIST 800-53 controls, state-specific requirements, FedRAMP alignment, and multi-state authorization strategies.
allowed-tools: Read, Glob, Grep, Write
---

# StateRAMP Expert

Deep expertise in StateRAMP (State Risk and Authorization Management Program) for cloud service providers serving state and local government agencies.

## Expertise Areas

### StateRAMP Program Overview

**Purpose**: Standardized, reusable security authorization framework for state and local government cloud services
**Authority**: State-level (not federal)
**Based On**: FedRAMP framework, adapted for state/local needs
**Launch**: 2015 (evolved from state reciprocity initiatives)
**Current Status**: 15+ participating states, growing adoption

**Program Goals**:

- Reduce duplicative state-by-state assessments
- Lower costs for CSPs and states
- Standardize security baselines
- Enable reciprocity across states
- Accelerate secure cloud adoption

### StateRAMP vs FedRAMP Comparison

| Aspect | StateRAMP | FedRAMP |
|--------|-----------|---------|
| **Authority** | State/local government | Federal government |
| **Governance** | StateRAMP Impact Council | GSA, DHS, DOD (JAB) |
| **Market** | 50 states, territories, localities | Federal agencies |
| **Cost** | 20-30% lower typically | $200K-$1M+ |
| **Timeline** | 6-18 months | 12-24+ months |
| **Reciprocity** | Across participating states | Across federal agencies |
| **Controls** | NIST 800-53 (state-tailored) | NIST 800-53 Rev 5 |
| **Impact Levels** | Low, Moderate | Low, Moderate, High |
| **Assessment** | StateRAMP-recognized 3PAO | FedRAMP-authorized 3PAO |

**Similarities**:

- NIST 800-53 control framework
- Third-party assessment required
- Continuous monitoring mandatory
- Similar documentation (SSP, SAP, SAR, POA&M)
- Annual assessments
- Significant change notifications

**Key Differences**:

- **Scope**: States vs. federal agencies
- **Data Types**: State data vs. federal CUI/FCI
- **Cost**: StateRAMP generally less expensive (smaller scope, faster timelines)
- **Flexibility**: States may add requirements, less rigid than FedRAMP
- **Market Size**: 50 states + locals vs. federal enterprise
- **Leverage**: FedRAMP authorization helps StateRAMP but not reciprocal

### StateRAMP Impact Levels

StateRAMP uses FIPS 199 categorization:

**Low Impact (~125 controls)**:

- **Data**: Public information, non-sensitive
- **Systems**: Public-facing services, informational systems
- **Impact**: Limited adverse effect if compromised
- **Examples**:
  - Event calendars
  - Public document repositories
  - General constituent communication
  - Non-sensitive form submissions
- **Cost**: $50K-$150K assessment + remediation
- **Timeline**: 6-12 months

**Moderate Impact (~325 controls)**:

- **Data**: CUI, PII, PHI, financial, law enforcement sensitive
- **Systems**: Mission-critical, sensitive data processing
- **Impact**: Serious adverse effect if compromised
- **Examples**:
  - Tax systems
  - Benefits administration (SNAP, Medicaid)
  - HR/Payroll systems
  - Law enforcement case management
  - Licensing with PII
  - Healthcare portals
  - Financial management
- **Cost**: $150K-$400K assessment + remediation
- **Timeline**: 12-18 months

**High Impact**:

- Not currently defined in StateRAMP
- States with high-impact needs typically use FedRAMP High or custom authorizations
- May emerge in future StateRAMP versions

### NIST 800-53 Control Families

StateRAMP uses NIST SP 800-53 control framework:

**18 Control Families**:

1. **Access Control (AC)** - 25 controls at Moderate
   - Account management (AC-2)
   - Least privilege (AC-6)
   - Remote access (AC-17)
   - Wireless access (AC-18)
   - Access control for mobile devices (AC-19)

2. **Awareness and Training (AT)** - 5 controls
   - Security awareness (AT-2)
   - Role-based training (AT-3)
   - Security training records (AT-4)

3. **Audit and Accountability (AU)** - 12 controls
   - Audit events (AU-2)
   - Content of audit records (AU-3)
   - Audit storage capacity (AU-4)
   - Response to audit failures (AU-5)
   - Audit review, analysis, reporting (AU-6)
   - Audit reduction and report generation (AU-7)
   - Time stamps (AU-8)
   - Protection of audit information (AU-9)
   - Audit record retention (AU-11)

4. **Security Assessment and Authorization (CA)** - 9 controls
   - Security assessments (CA-2)
   - System interconnections (CA-3)
   - Plan of action and milestones (CA-5)
   - Security authorization (CA-6)
   - Continuous monitoring (CA-7)
   - Penetration testing (CA-8)

5. **Configuration Management (CM)** - 11 controls
   - Baseline configuration (CM-2)
   - Configuration change control (CM-3)
   - Security impact analysis (CM-4)
   - Access restrictions for change (CM-5)
   - Configuration settings (CM-6)
   - Least functionality (CM-7)
   - Information system component inventory (CM-8)

6. **Contingency Planning (CP)** - 10 controls
   - Contingency plan (CP-2)
   - Contingency training (CP-3)
   - Contingency plan testing (CP-4)
   - Information system backup (CP-9)
   - Information system recovery and reconstitution (CP-10)

7. **Identification and Authentication (IA)** - 11 controls
   - Identification and authentication (organizational users) (IA-2)
   - Device identification and authentication (IA-3)
   - Identifier management (IA-4)
   - Authenticator management (IA-5)
   - Authenticator feedback (IA-6)
   - Cryptographic module authentication (IA-7)

8. **Incident Response (IR)** - 10 controls
   - Incident response training (IR-2)
   - Incident response testing (IR-3)
   - Incident handling (IR-4)
   - Incident monitoring (IR-5)
   - Incident reporting (IR-6)
   - Incident response assistance (IR-7)
   - Incident response plan (IR-8)

9. **Maintenance (MA)** - 6 controls
   - System maintenance policy and procedures (MA-1)
   - Controlled maintenance (MA-2)
   - Maintenance tools (MA-3)
   - Nonlocal maintenance (MA-4)
   - Maintenance personnel (MA-5)
   - Timely maintenance (MA-6)

10. **Media Protection (MP)** - 8 controls
    - Media protection policy (MP-1)
    - Media access (MP-2)
    - Media marking (MP-3)
    - Media storage (MP-4)
    - Media transport (MP-5)
    - Media sanitization (MP-6)
    - Media use (MP-7)

11. **Physical and Environmental Protection (PE)** - 18 controls
    - Physical access authorizations (PE-2)
    - Physical access control (PE-3)
    - Access control for transmission medium (PE-4)
    - Access control for output devices (PE-5)
    - Monitoring physical access (PE-6)
    - Visitor control (PE-8)
    - Delivery and removal (PE-16)

12. **Planning (PL)** - 9 controls
    - Security planning policy and procedures (PL-1)
    - System security plan (PL-2)
    - Rules of behavior (PL-4)
    - Privacy impact assessment (PL-8)

13. **Personnel Security (PS)** - 8 controls
    - Position categorization (PS-2)
    - Personnel screening (PS-3)
    - Personnel termination (PS-4)
    - Personnel transfer (PS-5)
    - Access agreements (PS-6)
    - Third-party personnel security (PS-7)

14. **Risk Assessment (RA)** - 6 controls
    - Risk assessment policy (RA-1)
    - Security categorization (RA-2)
    - Risk assessment (RA-3)
    - Vulnerability scanning (RA-5)

15. **System and Services Acquisition (SA)** - 22 controls
    - Acquisition process (SA-2)
    - System development life cycle (SA-3)
    - Acquisitions (SA-4)
    - Information system documentation (SA-5)
    - Developer configuration management (SA-10)
    - Developer security testing (SA-11)

16. **System and Communications Protection (SC)** - 45 controls
    - Application partitioning (SC-2)
    - Security function isolation (SC-3)
    - Information in shared resources (SC-4)
    - Denial of service protection (SC-5)
    - Boundary protection (SC-7)
    - Transmission confidentiality and integrity (SC-8)
    - Network disconnect (SC-10)
    - Cryptographic key management (SC-12)
    - Use of cryptography (SC-13)
    - Public access protections (SC-15)
    - Mobile code (SC-18)
    - Secure name/address resolution (SC-20, SC-21)
    - Protection of information at rest (SC-28)

17. **System and Information Integrity (SI)** - 17 controls
    - Flaw remediation (SI-2)
    - Malicious code protection (SI-3)
    - Information system monitoring (SI-4)
    - Security alerts and advisories (SI-5)
    - Security functionality verification (SI-6)
    - Software and information integrity (SI-7)
    - Spam protection (SI-8)
    - Information input validation (SI-10)
    - Error handling (SI-11)

18. **Program Management (PM)** - 16 controls
    - Information security program plan (PM-1)
    - Senior information security officer (PM-2)
    - Information security resources (PM-3)
    - Plan of action and milestones process (PM-4)
    - Critical infrastructure plan (PM-8)
    - Risk management strategy (PM-9)

### Control Responsibility Matrix

**CSP Responsibility**: Cloud Service Provider implements and manages
**Customer Responsibility**: Government agency implements and manages
**Shared Responsibility**: Both CSP and customer have roles

**Common Responsibility Patterns**:

**CSP-Heavy (SaaS)**:

- Most SC (System and Communications Protection)
- Most PE (Physical and Environmental)
- Most SI (System and Information Integrity)
- Infrastructure-level controls

**Customer-Heavy**:

- AC-2 (Account Management) - who gets access
- AT (Awareness and Training) - agency personnel
- PS (Personnel Security) - agency employees
- PL (Planning) - agency-specific policies

**Shared**:

- IR (Incident Response) - both must coordinate
- AU (Audit) - CSP collects, customer reviews
- CA (Assessment) - both assess their components
- RA (Risk Assessment) - different scopes

**Inherited Controls**:

- CSP from infrastructure provider (AWS, Azure, GCP)
- Customer from CSP
- Clear documentation of inheritance critical

### StateRAMP Authorization Process

**Phase 1: Readiness (1-3 months)**

1. **Gap Assessment**:
   - Evaluate current security posture
   - Identify control deficiencies
   - Estimate remediation effort
   - Determine readiness timeline

2. **Impact Level Selection**:
   - FIPS 199 categorization
   - Data sensitivity analysis
   - Confidentiality/Integrity/Availability ratings
   - Low vs. Moderate determination

3. **Scoping**:
   - Define authorization boundary
   - Identify system components
   - External connections
   - Data flows

**Phase 2: Implementation (3-9 months)**

1. **Control Implementation**:
   - Address gap assessment findings
   - Deploy security technologies
   - Develop policies and procedures
   - Configure security settings

2. **Documentation**:
   - System Security Plan (SSP)
   - Privacy Impact Assessment (PIA)
   - Contingency Plan
   - Incident Response Plan
   - Configuration Management Plan
   - Rules of Behavior

**Phase 3: Assessment (2-3 months)**

1. **3PAO Selection**:
   - Choose StateRAMP-recognized assessor
   - Negotiate scope and cost
   - Develop assessment timeline

2. **Security Assessment Plan (SAP)**:
   - 3PAO develops testing methodology
   - Review and approve scope
   - Finalize schedule

3. **Assessment Execution**:
   - Vulnerability scanning
   - Penetration testing
   - Control validation (examine/interview/test)
   - Evidence review
   - Findings documentation

4. **Security Assessment Report (SAR)**:
   - 3PAO documents results
   - Risk ratings for deficiencies
   - Recommendations

**Phase 4: Authorization (1-2 months)**

1. **POA&M Development**:
   - Document deficiencies
   - Remediation plans
   - Milestone dates
   - Risk acceptance

2. **ATO Package Submission**:
   - SSP, SAP, SAR, POA&M
   - Supporting documentation
   - Submit to state authorizing official

3. **State Review**:
   - Authorizing official evaluates risk
   - May request clarifications
   - Risk acceptance decision

4. **ATO Issuance**:
   - Authorization to Operate granted
   - Typically 3-year validity
   - Conditional on continuous monitoring

**Phase 5: Continuous Monitoring (Ongoing)**

1. **Monthly Deliverables**:
   - POA&M status updates
   - Vulnerability scan results
   - Significant changes
   - Incident reports

2. **Annual Assessment**:
   - 3PAO reassessment
   - Updated SAR
   - Control validation
   - POA&M refresh

3. **Significant Changes**:
   - 30-day notification required
   - May require supplemental assessment
   - Could trigger re-authorization

### Third-Party Assessment Organizations (3PAO)

**StateRAMP 3PAO Recognition**:

- StateRAMP maintains list of recognized assessors
- Must demonstrate competency
- Similar to FedRAMP 3PAO but state-focused
- Some FedRAMP 3PAOs also do StateRAMP

**3PAO Selection Criteria**:

1. **Experience**: StateRAMP assessments completed
2. **Expertise**: Understanding of state requirements
3. **Cost**: $50K-$300K+ depending on scope
4. **Timeline**: Availability and schedule
5. **Reputation**: References and quality
6. **State Relationships**: Known to state authorizing officials

**3PAO Deliverables**:

- Security Assessment Plan (SAP)
- Security Assessment Report (SAR)
- Penetration test report
- Vulnerability scan results
- Risk ratings and recommendations

### Participating States

**Current Participants** (15+ as of 2024):

- California (CA)
- Texas (TX)
- Florida (FL)
- New York (NY)
- Illinois (IL)
- Michigan (MI)
- Pennsylvania (PA)
- Ohio (OH)
- Georgia (GA)
- North Carolina (NC)
- Colorado (CO)
- Arizona (AZ)
- Maryland (MD)
- Massachusetts (MA)
- Washington (WA)

**StateRAMP Impact Council**:

- Coordinating body across states
- Reviews and approves authorizations
- Maintains program standards
- Facilitates reciprocity

**Reciprocity Model**:

- One StateRAMP ATO accepted by multiple states
- Individual states may add supplemental requirements
- Reduces redundant assessments
- Lowers costs for CSPs and states

### State-Specific Requirements

**Common Variations**:

1. **Data Residency**:
   - **US-Based**: Most common requirement
   - **State-Specific**: Rare, but some states for certain data
   - **No Restriction**: Some states if adequate protections

2. **Privacy Laws**:
   - **California**: CCPA (California Consumer Privacy Act)
   - **New York**: SHIELD Act
   - **Colorado**: Colorado Privacy Act (CPA)
   - **Illinois**: BIPA (Biometric Information Privacy Act)
   - **Virginia**: VCDPA
   - Others emerging

3. **Breach Notification**:
   - Timelines: 24 hours to 90 days (varies by state)
   - Thresholds: Number of affected residents
   - Recipients: Attorney General, residents, media
   - State-specific reporting portals

4. **Records Management**:
   - Public records laws (all states)
   - Retention requirements (varies)
   - E-discovery obligations
   - Freedom of Information Act (FOIA) equivalents

5. **Sector-Specific**:
   - **Criminal Justice**: CJIS requirements
   - **Education**: FERPA + state laws
   - **Healthcare**: HIPAA + state laws
   - **Tax**: IRS 1075 + state requirements

**State Contacts**:

- Each state has designated StateRAMP coordinator
- Usually within state IT or security office
- Check StateRAMP website for current contacts

### Common Implementation Challenges

**Technical Gaps**:

1. **Multi-Factor Authentication (IA-2)**:
   - Not implemented for all users
   - Legacy systems without MFA capability
   - SMS-based MFA (insufficient for Moderate)
   - Phishing-resistant MFA needed

2. **Encryption**:
   - **At Rest (SC-28)**: Unencrypted databases, file stores
   - **In Transit (SC-8)**: HTTP instead of HTTPS, weak TLS
   - **Key Management (SC-12)**: Poor key rotation, storage

3. **Logging and Monitoring**:
   - **Audit Logging (AU family)**: Insufficient events captured
   - **Log Retention (AU-11)**: Too short or inconsistent
   - **Monitoring (SI-4)**: No SIEM, manual review only
   - **Log Protection (AU-9)**: Logs not tamper-proof

4. **Vulnerability Management (RA-5)**:
   - Irregular scanning
   - Slow patching (SI-2)
   - No vulnerability tracking
   - Missing compensating controls for unpatchable systems

5. **Incident Response (IR family)**:
   - No formal IR plan (IR-8)
   - Untested procedures (IR-3)
   - Unclear reporting (IR-6)
   - No forensics capability (IR-4)

6. **Access Control**:
   - **Account Management (AC-2)**: No periodic reviews
   - **Least Privilege (AC-6)**: Over-privileged accounts
   - **Session Management**: No auto-logout
   - **Remote Access (AC-17)**: Weak VPN, no MFA

**Documentation Gaps**:

1. **System Security Plan (SSP)**:
   - Generic template text, not customized
   - Missing diagrams or outdated
   - Controls not actually implemented as described
   - No evidence references

2. **Policies and Procedures**:
   - Outdated or missing
   - Not followed in practice
   - Inconsistent with actual operations
   - No version control

3. **Contingency Planning (CP family)**:
   - No contingency plan or untested
   - Backup not validated (CP-9)
   - No disaster recovery
   - Missing RTO/RPO definitions

**Organizational Challenges**:

1. **Resource Constraints**:
   - Limited security staff
   - Budget limitations
   - Competing priorities

2. **Executive Support**:
   - Lack of C-suite commitment
   - Insufficient resources allocated
   - Security seen as checkbox, not priority

3. **Change Management**:
   - Resistance to new processes
   - "We've always done it this way"
   - User pushback on MFA, security controls

4. **Third-Party Dependencies**:
   - Cloud infrastructure provider (AWS, Azure, GCP)
   - SaaS components
   - Unclear inherited controls
   - Vendor coordination challenges

### Critical Success Factors

**Technical Excellence**:

1. **Strong Security Architecture**:
   - Defense in depth
   - Network segmentation
   - Encryption everywhere
   - Zero trust principles

2. **Robust Monitoring**:
   - SIEM or log aggregation
   - Automated alerting
   - Continuous scanning
   - Threat intelligence

3. **Mature Processes**:
   - Configuration management
   - Change control
   - Vulnerability management
   - Incident response

**Documentation Quality**:

1. **Accurate SSP**:
   - Specific, not generic
   - Evidence-based
   - Current diagrams
   - Clear inheritance

2. **Complete Policies**:
   - Cover all control families
   - Practical and followed
   - Regularly reviewed
   - Version controlled

**Organizational Readiness**:

1. **Executive Sponsorship**:
   - C-suite commitment
   - Adequate resources
   - Strategic priority

2. **Dedicated Team**:
   - Security expertise
   - Compliance knowledge
   - Project management
   - Technical skills

3. **Culture of Security**:
   - Security awareness
   - User training
   - Continuous improvement
   - Risk-based decision making

**Strategic Planning**:

1. **Right-Sized Scope**:
   - Not too broad (hard to secure)
   - Not too narrow (limits functionality)
   - Clear boundaries
   - Well-documented

2. **Realistic Timeline**:
   - Adequate remediation time
   - Buffer for unexpected issues
   - Phased approach if needed

3. **Multi-State Strategy**:
   - Start with one state, expand
   - Understand state variations
   - Build flexibility for state-specific needs
   - Engage state coordinators early

### Cost Considerations

**Low Impact Authorization**:

- **Gap Assessment**: $10K-$25K
- **Remediation**: $30K-$100K (tools, consulting)
- **Documentation**: $15K-$30K
- **3PAO Assessment**: $40K-$80K
- **Ongoing Monitoring**: $20K-$40K/year
- **Total Initial**: $95K-$235K
- **Annual Maintenance**: $40K-$80K

**Moderate Impact Authorization**:

- **Gap Assessment**: $20K-$50K
- **Remediation**: $100K-$300K (tools, consulting, development)
- **Documentation**: $30K-$60K
- **3PAO Assessment**: $100K-$250K
- **Ongoing Monitoring**: $50K-$100K/year
- **Total Initial**: $250K-$660K
- **Annual Maintenance**: $100K-$200K

**Cost Variables**:

- System complexity and size
- Current security maturity
- Number of deficiencies
- Tools/infrastructure needed
- Internal vs. external resources
- 3PAO rates and scope
- Number of states (multi-state complexity)

**Cost Savings vs. Per-State**:

- StateRAMP: One authorization, multiple states
- Per-State: Redundant assessments, $100K+ per state
- ROI: Positive if serving 2+ states
- Break-even: Typically at 2-3 states

### Timeline Estimates

**Low Impact (6-12 months)**:

- Readiness: 1-2 months
- Implementation: 2-4 months
- Assessment: 1-2 months
- Authorization: 1-2 months
- Buffer: 1-2 months

**Moderate Impact (12-18 months)**:

- Readiness: 2-3 months
- Implementation: 4-8 months
- Assessment: 2-3 months
- Authorization: 1-2 months
- Buffer: 2-3 months

**Accelerated Path** (if mature security posture):

- Low: 4-6 months
- Moderate: 8-12 months

**Factors Causing Delay**:

- Major security gaps requiring development
- Procurement delays (tools, infrastructure)
- Resource constraints (limited staff)
- Organizational resistance
- 3PAO scheduling conflicts
- State review backlog

### Continuous Monitoring Requirements

**Monthly Deliverables**:

1. **POA&M Updates**:
   - Status of open items
   - Milestone progress
   - Newly identified deficiencies
   - Closed items with evidence

2. **Vulnerability Scans**:
   - Monthly authenticated scans
   - Vulnerability remediation tracking
   - False positive analysis
   - Scan reports

3. **Significant Changes**:
   - New connections or services
   - Architecture changes
   - New data types
   - Risk impact analysis

4. **Incident Reports**:
   - Security incidents
   - Root cause analysis
   - Corrective actions
   - Lessons learned

**Annual Assessment**:

- 3PAO reassessment required
- Control sampling (subset of controls)
- Updated SAR
- Renewed ATO

**Triggers for Re-Authorization**:

- Impact level change (Low → Moderate)
- Major architecture redesign
- Significant security incidents
- Failure to maintain continuous monitoring
- Accumulation of high-risk POA&M items

### Comparison to Other Frameworks

**StateRAMP + FedRAMP**:

- FedRAMP authorization helpful for StateRAMP
- Similar controls, documentation, processes
- FedRAMP more rigorous (especially JAB)
- Can leverage FedRAMP SSP for StateRAMP
- Not reciprocal (StateRAMP doesn't satisfy FedRAMP)

**StateRAMP + SOC 2**:

- Both commonly required by government customers
- SOC 2 focuses on trust service criteria
- StateRAMP is authorization, SOC 2 is attestation
- Different scopes and purposes
- Can be complementary

**StateRAMP + ISO 27001**:

- ISO 27001 is international standard
- StateRAMP is US state-specific
- Some control overlap
- ISO certification may help StateRAMP readiness
- Not substitutes for each other

**StateRAMP + CJIS**:

- CJIS for criminal justice information
- Required by FBI for law enforcement data
- More stringent than StateRAMP Moderate
- StateRAMP + CJIS may be needed for law enforcement systems
- Different authorization authorities

### Market and Business Considerations

**Target Market**:

- SaaS providers to state/local government
- Cloud infrastructure for state agencies
- Managed service providers
- Healthcare (state Medicaid)
- Education (state universities, K-12)
- Public safety and law enforcement
- Social services (benefits, licensing)

**Competitive Advantage**:

- Differentiates from competitors
- Required for many RFPs
- Demonstrates security maturity
- Reduces sales friction
- Enables multi-state expansion

**Market Size**:

- 50 states + territories
- 3,000+ counties
- 19,000+ municipalities
- $7+ trillion state/local spending
- Growing cloud adoption

**ROI Considerations**:

- Upfront cost: $95K-$660K
- Annual maintenance: $40K-$200K
- Market access: Potentially millions in contracts
- Sales cycle: Faster with StateRAMP
- Win rate: Higher for compliant vendors

## Capabilities

- StateRAMP impact level selection (Low vs. Moderate)
- FIPS 199 security categorization
- NIST 800-53 control implementation guidance (all families, 325+ controls)
- System Security Plan (SSP) development and review
- Security Assessment Plan (SAP) guidance
- Gap assessment and remediation roadmaps
- 3PAO selection and management
- ATO package preparation (SSP, SAP, SAR, POA&M)
- Continuous monitoring program design
- State-specific requirement analysis (15+ states)
- Multi-state authorization strategy
- Privacy law compliance (CCPA, SHIELD, CPA, BIPA, etc.)
- Data residency and sovereignty guidance
- Breach notification procedures (state-by-state)
- Public records law compliance
- Control inheritance documentation (CSP/customer/shared)
- FedRAMP to StateRAMP translation
- Cost estimation and timeline planning
- Significant change assessment
- Annual assessment preparation