Skip to main content

Analysis

GovRAMP vs FedRAMP vs StateRAMP: what each one actually checks

GovRAMP and FedRAMP are run by different bodies for different buyers. A listing in one has no public evidence in the other. Here is how to tell them apart.

Solomon AmosPublished 18 Oct 20269 min read

A vendor's security page sometimes lists GovRAMP and FedRAMP in the same breath, as if clearing one clears the other. It does not. These are two separate marketplaces, run by two separate organisations, assessing two separate buyer populations, and a vendor can hold a current status in one while having no public record at all in the other. This matters because procurement teams in city, county, state and education buyers often ask for FedRAMP when GovRAMP is the programme that actually applies to them, and federal buyers sometimes accept a GovRAMP listing as if it were a federal authorization, which it is not.

Two different bodies, two different marketplaces

FedRAMP is a US federal government programme. Authorizations are issued through a federal agency sponsor or the FedRAMP Program Management Office, and the system of record is the FedRAMP Marketplace itself, which the index's FedRAMP page mirrors for public evidence. GovRAMP is not a federal programme. It is an independent, state-government-backed nonprofit that verifies cloud and cybersecurity products for state and local government and education buyers, and its own register is what the GovRAMP framework page, linked below, draws from. The two bodies do not share a review, a sponsor pool or an assessor panel, so a status recorded in one system is not visible, and is not meant to be visible, in the other.

What FedRAMP actually authorizes

FedRAMP exists so that a cloud service does not need to be separately assessed by every federal agency that wants to use it. A cloud offering goes through a security assessment against FedRAMP's baseline controls, and once authorized, agencies can reuse that authorization package rather than starting from scratch. The labelling has changed recently: since 4 July 2026, the official status for an authorized offering is 'FedRAMP Certified' under the Consolidated Rules for 2026, and the older 'Ready' designation became legacy on 28 July 2026, so a vendor still advertising FedRAMP Ready as its current state is describing a status that no longer carries the same weight. The detail on what changed and why is covered in FedRAMP in 2026: Certified replaces Authorized, Ready is retired, 20x goes live.

What GovRAMP actually verifies

GovRAMP's scope sits below the federal line. It was built for state and local governments and public education institutions that needed a shared way to evaluate cloud and cybersecurity vendors without every state running its own assessment programme. A GovRAMP record shows a status such as Ready, In Process or Authorized, tied to a specific service offering and a specific set of sponsoring government entities. None of this touches federal agency procurement, and none of it is drawn from, or feeds into, the FedRAMP Marketplace. Full detail on what the register itself shows is on the GovRAMP framework page.

The StateRAMP rebrand, explained

Some of the confusion is historical rather than structural. GovRAMP is the current name of the organisation that was previously known as StateRAMP. The rebrand reflected the fact that its membership and its authorized vendor base had grown to include local governments and education buyers, not just state agencies, so the narrower name no longer matched the programme it ran. The governance, the assessment approach and the register itself carried over under the new name. If an older document or a vendor page still refers to StateRAMP Authorized, that is very likely the same programme now operating as GovRAMP, not a third, separate scheme.

Diagram showing GovRAMP and FedRAMP as separate marketplaces with no shared data feed between them
Two registers, two governing bodies, no automatic crossover of status.

Side by side

ProgrammeGoverning bodyBuyer populationCurrent status labelPublic register
FedRAMPUS federal government (PMO, agency sponsors)Federal agenciesFedRAMP Certified (since 4 July 2026)FedRAMP Marketplace
GovRAMPIndependent nonprofit (formerly StateRAMP)State, local and education government bodiesReady, In Process, AuthorizedGovRAMP register
StateRAMPSame organisation as GovRAMP, prior nameSame as GovRAMPLegacy name, same statusesSuperseded by the GovRAMP register

FedRAMP and GovRAMP track different buyers under different bodies; StateRAMP is GovRAMP's earlier name.

Why a listing in one has no public evidence in the other

This is the point worth sitting with. A vendor can be fully authorized under GovRAMP and have no record at all on the FedRAMP Marketplace, because no federal agency has sponsored it and it has never gone through a federal assessment. The reverse is just as common: a vendor can hold a FedRAMP authorization aimed at federal customers and never have submitted anything to GovRAMP, because its sales motion has nothing to do with state or local procurement. Neither absence is a red flag on its own. What is a problem is a vendor's marketing page implying coverage it does not have, for example describing itself as serving all levels of government on the strength of one programme alone. Checking the actual registers, rather than the summary on a vendor's website, is the only way to know which buyers a given authorization actually covers. How to Verify a FedRAMP Marketplace Listing walks through the federal side of that check in detail.

  1. 1

    Identify the claim

    Note the exact wording on the vendor's page: FedRAMP, GovRAMP, or both, and whether a status word like Certified, Authorized or Ready is attached.

  2. 2

    Check the right register

    FedRAMP claims should be checked against the FedRAMP Marketplace. GovRAMP claims should be checked against the separate GovRAMP register.

  3. 3

    Match the offering, not the company

    Authorizations in both programmes attach to a specific cloud service or offering, not to the vendor as a whole. A company can have one authorized product and ten unauthorized ones.

  4. 4

    Check the date

    A status with no recent assessment date, or one still using a retired label such as Ready for a federal offering, should be treated as unverified until confirmed directly.

  5. 5

    Do not assume crossover

    If a vendor needs to serve both federal and state or local buyers, look for separate, current entries in both registers. One does not stand in for the other.

For a single vendor page that happens to show entries in both government programmes side by side, it helps to look at what each row actually states rather than assuming the badges mean the same thing. The card below shows a vendor that carries FedRAMP alongside GovRAMP and a run of other regional government schemes, which makes the distinction between them easy to see in one place.

Zoom logo

Zoom · Trust report

Collaboration · Public evidence as of 19 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 18 vendor-stated.

10 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Zoom publishes or offers, as of 19 Oct 2026.

  • Standard contractual clauses · On request
  • AI and data use policy · On request

1Security practices

Public statements from Zoom, shown as statements, not attestations, as of 19 Oct 2026.

  • Penetration testing · report available
FedRAMP and GovRAMP appear as separate rows because they come from separate registers, not one combined status. Every line is a dated public record from the Data Privacy Framework list and Zoom's trust centre. A framework not shown means no public evidence was found, not that Zoom lacks it.CertReports

How often these actually overlap

Vendors that sell into both federal and sub-federal government rarely rely on a single authorization to cover everything, because the programmes do not recognise each other's work. A large government-facing platform may carry a FedRAMP authorization for its federal-facing offering and a separate GovRAMP authorization, under its own assessment, for a product aimed at state agencies. Both can be true at once, and both have to be checked independently.

2
governing bodies
FedRAMP (federal government) and GovRAMP (independent nonprofit) do not share one review process
1
renamed programme
GovRAMP is the current name for what was previously run as StateRAMP
0
automatic crossover
No FedRAMP authorization confers a GovRAMP status, or the reverse, in the CertReports index on 2026-10-18
Checklist icons for verifying a vendor's FedRAMP and GovRAMP claims against their separate public registers
Each claim needs its own register check, by offering, not by company name.
GovRAMP verifies that cloud and cybersecurity products and services meet consistent security standards for state and local government and education institutions.

Common mistakes buyers make with these labels

  • Treating GovRAMP Authorized as equivalent to a federal authorization when evaluating a vendor for federal use.
  • Accepting FedRAMP Ready as current evidence, when Ready became a legacy label on 28 July 2026 under the Consolidated Rules.
  • Assuming a StateRAMP badge on an older document is a defunct or third programme, rather than the earlier name for GovRAMP.
  • Not checking which specific offering an authorization covers, since a vendor's flagship product and its newer add-on may sit in different states.
  • Skipping the underlying register entirely and relying on a vendor's own compliance page summary.

A quick way to separate the claims

If the buyer is a federal agency, the only programme that matters is FedRAMP, checked against the Marketplace. If the buyer is a state, county, city or public education body, GovRAMP is the relevant programme, and a federal authorization does not substitute for it. Treat StateRAMP as a historical label for the same body now operating as GovRAMP.

Where this sits against the rest of the public record

GovRAMP and FedRAMP are two entries in a much longer list of government and regional authorization schemes that vendors publish selectively. State-level variants such as TX-RAMP exist alongside GovRAMP for jurisdictions that run their own programme rather than joining the shared one, and international equivalents like IRAP or ISMAP serve the same narrow, buyer-specific function in other countries. The state of public compliance evidence in 2026 looks at how unevenly vendors publish this kind of government-specific evidence compared with broader frameworks like SOC 2 or ISO 27001. The pattern holds here too: a badge on a marketing page is a claim, and the register is the only place that claim can actually be confirmed.

People also ask

What is govramp vs fedramp?

GovRAMP and FedRAMP are separate government cloud security programmes run by separate bodies. FedRAMP is a US federal government programme that authorizes cloud services for federal agency use, tracked on the FedRAMP Marketplace. GovRAMP, previously called StateRAMP, is an independent nonprofit that verifies vendors for state, local and education government buyers. A status in one register is not recorded in the other.

What is the difference between govramp and fedramp?

The core difference is the buyer population and the governing body. FedRAMP covers federal agencies and is tied to the federal government's own assessment process, now labelled FedRAMP Certified since 4 July 2026. GovRAMP covers state, local and education government buyers and is run by an independent nonprofit with its own authorization statuses, separate from any federal review.

Is govramp the same as fedramp?

No. They are run by different organisations, use different assessment criteria, and serve different government buyers. A vendor can appear in the FedRAMP Marketplace with no entry in the GovRAMP register, or the reverse, because neither programme automatically recognises the other's authorization work.

Is govramp the same as stateramp?

Yes, in the sense that matters for verification. GovRAMP is the current name of the organisation previously known as StateRAMP, following a rebrand that reflected its growing scope beyond state agencies into local government and education. The assessment approach and authorized vendor base carried over under the new name, so a StateRAMP reference on an older document generally points to the same programme now called GovRAMP.

What is govramp and fedramp?

GovRAMP and FedRAMP are both authorization programmes that let government buyers rely on a shared security assessment rather than running their own review of every vendor. FedRAMP serves US federal agencies. GovRAMP, formerly StateRAMP, serves state, local and education government buyers. They operate independently, with separate registers and separate governing bodies.

GovRAMPFedRAMPStateRAMPgovernment cloudcompliance frameworks
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like