Skip to main content

How-to

How to Get GovRAMP Certified: Tiers, Core and Authorization

A walk-through of GovRAMP's Core, Ready and Authorized tiers, and what a vendor's public GovRAMP framework entry actually discloses at each stage.

Solomon AmosPublished 19 Oct 20269 min read

GovRAMP is the programme most people still search for under its old name, StateRAMP. It lets state, local and education government buyers in the United States rely on one standardised security review instead of each agency running its own assessment of the same cloud product. The search phrase 'how to get GovRAMP certified' is the most common way both buyers and vendors ask about it, but the programme itself does not hand out a certificate. It grants an authorization status at one of a small number of tiers, and it recently added a lighter-weight Core designation that sits below full authorization. This article walks through what each tier and designation actually requires, and what a vendor's public GovRAMP framework entry actually discloses once you know which fields to check, rather than relying on the wording a vendor chooses for its own trust page.

What GovRAMP checks, and what changed when StateRAMP became GovRAMP

StateRAMP rebranded to GovRAMP to reflect how broad its membership had grown: state agencies, local governments, school districts, and some tribal and territorial bodies now sit inside the same authorization scheme. The programme runs independently of the federal government's own scheme, tracked separately in the FedRAMP registry mirror, which only covers agencies of the US federal government. The two share a lot of structure. Both lean on accredited third-party assessors, both map to NIST SP 800-53 controls, and GovRAMP explicitly allows a vendor to reuse an existing FedRAMP package to shorten its own review. For the fuller comparison of scope and reciprocity between the two, GovRAMP vs FedRAMP vs StateRAMP covers the detail. What has not changed with the rebrand is the basic transaction: a vendor pays for an assessment, a government Authorizing Official reviews the result, and the outcome is published on a government-run list, not decided by the vendor's own marketing copy.

There is no GovRAMP certificate to earn

GovRAMP does not issue a certification mark. It grants an authorization status, either Ready or Authorized, or the lighter Core designation sitting below both. Vendors and procurement teams who search for 'GovRAMP certified' are usually asking about one of these three outcomes. The naming matters in the same way FedRAMP's own terminology does: since 4 July 2026 the federal programme's official label is 'FedRAMP Certified' under the Consolidated Rules, a specific legal designation rather than a loose way of saying a vendor passed a review. See FedRAMP in 2026 for how that change showed up on vendor listings.

The three GovRAMP tiers: Core, Ready and Authorized

A vendor's public GovRAMP status will land in one of three places, and each means something different to a buyer evaluating risk.

  • Core: the entry-level designation, built on narrower evidence than a full third-party assessment, intended for lower-risk cloud products that state and local agencies still want some baseline assurance on before procurement.
  • Ready: the assessment is complete. An accredited Third-Party Assessment Organization has reviewed the vendor's System Security Plan and supporting evidence, but no government Authorizing Official has yet granted authorization.
  • Authorized: the full outcome. A state or local Authorizing Official has reviewed the assessment package and formally accepted the risk of using the product, and the listing appears against that sponsoring agency.
Core, Ready and Authorized exist so a government buyer can tell, at a glance, how much independent verification sits behind a vendor's claim, from a narrower baseline to a fully assessed authorization.
Ladder diagram showing GovRAMP Core, Ready and Authorized tiers and their verification method
Core relies on narrower evidence; Ready and Authorized both require an accredited third-party assessment.

Security categories: matching the tier to the data

Alongside the tier, GovRAMP assigns a security category to the product itself, numbered 1 to 3 and scaled to how sensitive the data involved is, in the same spirit as FedRAMP's Low, Moderate and High impact levels. A records management tool handling low-sensitivity administrative data sits at a lower category than a system processing criminal justice or tax information. The category shapes how deep the assessment needs to be, and it should appear on the vendor's public entry alongside the tier itself, not just in the underlying assessment package. A vendor correctly listed as 'GovRAMP Authorized, Category 2' has told a buyer something specific. A vendor that only says 'GovRAMP Authorized' has left out half the information a procurement team actually needs.

How to get GovRAMP authorized: the realistic path

The path looks different depending on whether the end goal is Core, Ready or full Authorized status, but the sequence below covers the realistic route for a vendor aiming at full authorization.

  1. 1

    Pick the right security category

    Work out whether the product handles data that sits at Category 1, 2 or 3, since this decides how deep the assessment needs to go before anything else is worth doing.

  2. 2

    Decide which tier actually fits the sales motion

    Core suits a vendor selling lower-risk tools to many small agencies. Ready or Authorized suits a vendor pursuing larger state contracts where full authorization is a procurement requirement.

  3. 3

    Reuse an existing FedRAMP package where one exists

    A vendor that already holds a federal authorization can carry over much of its System Security Plan and assessment evidence rather than starting from nothing.

  4. 4

    Engage an accredited third-party assessor

    Ready and Authorized both require an assessment carried out by a Third-Party Assessment Organization accredited for the programme, not an internal self-assessment.

  5. 5

    Submit the package for review

    The completed package goes to GovRAMP's programme management for review before it can move toward Ready status.

  6. 6

    Find a sponsoring Authorizing Official

    Full Authorized status needs a state or local government body willing to review the package and formally accept the risk, which is the step many vendors underestimate on a first attempt.

  7. 7

    Commit to continuous monitoring

    Authorization is not a one-off event. It depends on an ongoing monitoring package and periodic reassessment to stay current.

Flow diagram showing a vendor reusing an existing FedRAMP assessment package inside a GovRAMP submission
Vendors that already hold a FedRAMP package can carry much of it into a GovRAMP submission rather than starting over.

Reading a vendor's public GovRAMP framework entry

A badge that just says 'GovRAMP' on a vendor's own trust page is not enough to act on. The entry worth reading sits on a vendor's own GovRAMP framework page or on the programme's own published list, and it should name the tier, the category, the assessor and a date, not just a logo.

Field on the entryWhat it should showWhy it matters
TierCore, Ready or Authorized, named explicitlyA badge that only says 'GovRAMP' without a tier could mean almost any level of verification
Security categoryCategory 1, 2 or 3Tells a buyer how sensitive the data the product is cleared to handle actually is
AssessorThe name of the accredited Third-Party Assessment OrganizationConfirms Ready or Authorized status came from an independent review, not self-attestation
Sponsoring Authorizing OfficialThe state or local body that granted statusAuthorized status is tied to a specific government sponsor, not a blanket approval
Date granted and reassessment dueAn actual date, not the word 'current'Authorization depends on continuous monitoring, so a stale date is worth questioning

What a GovRAMP framework entry should disclose beyond a badge.

Zoom's public compliance listing names GovRAMP alongside several other government and cross-border frameworks, which makes it a reasonable place to practise reading a real entry rather than a marketing graphic. Look at which specific tier is named against GovRAMP, whether a security category appears, and whether the entry points toward the programme's own published list rather than resting on prose alone.

Zoom logo

Zoom · Trust report

Collaboration · Public evidence as of 19 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 18 vendor-stated.

10 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Zoom publishes or offers, as of 19 Oct 2026.

  • Standard contractual clauses · On request
  • AI and data use policy · On request

1Security practices

Public statements from Zoom, shown as statements, not attestations, as of 19 Oct 2026.

  • Penetration testing · report available
Zoom's framework list places GovRAMP next to FedRAMP, TX-RAMP and other regional government programmes. Every line is a dated public record from the Data Privacy Framework list and Zoom's trust centre. A framework not shown means no public evidence was found, not that Zoom lacks it.CertReports

Common mistakes buyers and vendors make with GovRAMP status

  • Treating 'GovRAMP member' or 'GovRAMP participant' as equivalent to an authorization tier. Membership and participation are not Core, Ready or Authorized.
  • Assuming Core designation carries the same weight as a full third-party assessment, when it is built on narrower, often self-attested evidence.
  • Quoting an authorization that lapsed after reassessment was due, rather than checking the current date on the programme's own list.
  • Assuming GovRAMP and FedRAMP automatically recognise each other's outcomes, when reuse of a package still requires its own GovRAMP review.
  • Checking only the vendor's own trust page instead of the government-run list. The same habit matters across every authorization programme, covered in How to Verify a FedRAMP Marketplace Listing.
  • Reading a trust centre summary and stopping there. A fuller walk-through of what these pages actually show sits in How to read a trust centre in ten minutes.

Keeping a GovRAMP authorization current

Authorized status is not permanent once granted. It depends on a continuous monitoring package, usually reviewed on an annual cycle, and a reassessment if the product or its infrastructure changes materially. A vendor that stops submitting monitoring evidence can have its authorization revoked, which means the status shown on a vendor's own page can lag behind what the programme's own list currently says. Buyers running procurement against a GovRAMP requirement should treat the date on the entry as the operative fact, not the presence of a logo.

3
security categories
Category 1, 2 and 3 scale to data sensitivity, in the same spirit as FedRAMP's Low, Moderate and High impact levels
3
authorization tiers
Core, Ready and Authorized are the stages a public GovRAMP entry should name explicitly
Annual
typical monitoring cycle
Authorized status depends on an ongoing continuous monitoring package, not a single point-in-time assessment

People also ask

How to get govramp certified?

GovRAMP does not issue a certificate, so there is no single certified status to earn. A vendor instead works toward one of three outcomes: the entry-level Core designation, GovRAMP Ready after a third-party assessment, or full GovRAMP Authorized once a state or local Authorizing Official grants it. The practical path runs through an accredited assessor, a System Security Plan, and ideally an existing FedRAMP package to reuse.

How to get govramp?

Start by deciding which tier fits the product: Core for lower-risk services, Ready or Authorized for anything handling sensitive government data. Engage a GovRAMP-accredited third-party assessor, build the required security documentation, and submit the package through GovRAMP's process. Full authorization also needs a sponsoring state or local Authorizing Official willing to review and grant status, which is the step many vendors underestimate.

What is govramp certification used for?

Despite the common phrase, GovRAMP is used as an authorization framework, not a certification. State, local and education government buyers use a vendor's GovRAMP status to avoid re-running their own security assessment of a cloud or SaaS product that another government body has already reviewed. It standardises procurement security checks across agencies that would otherwise each ask the same questions separately.

What is govramp authorization?

GovRAMP authorization is the formal outcome once a state or local Authorizing Official reviews a vendor's third-party security assessment and agrees the product can handle government data at a given security category. It sits above GovRAMP Ready, which means the assessment is complete but no Authorizing Official has yet granted status, and above the entry-level Core designation.

What is govramp core?

GovRAMP Core is the programme's lighter-weight designation, aimed at lower-risk cloud products that do not need the full cost of a third-party assessed Ready or Authorized status. It relies on narrower, often self-attested evidence rather than a complete independent assessment, which makes it a faster entry point but a weaker signal than full authorization for buyers evaluating sensitive workloads.

GovRAMPStateRAMPFedRAMPgovernment procurementauthorization
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like