StateRAMP: How state and local governments accelerate cloud adoption

Membership to StateRAMP, a nonprofit organization that will offer cloud security verification services to state and local governments, opens next month. Modeled after the Federal Risk and Authorization Management Program (FedRAMP) and leveraging the National Institute of Standards and Technology’s  (NIST) 800-53 controls, StateRAMP aims to bring standardization and efficiency to cloud service providers (CSPs) and agencies alike.

Vendors will undergo an assessment similar to FedRAMP to validate that they meet security controls at the low, moderate and high levels. Agencies that contract with validated CSPs may not need to conduct their own assessments, a process that’s often redundant as companies work with multiple state and local agencies on similar programs.

The StateRAMP steering committee wanted “to bring state and local governments and the providers together to recognize set of standards, to recognize a common method for verification so that together, we can improve the cybersecurity posture of everybody,” StateRAMP Executive Director Leah McGrath said.

Launched in January, the focus so far has been on awareness and outreach, she said. The committee and board of directors have spent more than 1,000 hours on the effort, said Joe Bielawski, president of Knowledge Services and a StateRAMP board member. That time has included conversations with 25 states and presentations to 44 of the more than 800 CSPs that are interested in the program.

StateRAMP will have six security statuses: Active, Pending, Ready, In Process, Provisional and Authorized. A StateRAMP Marketplace will list CSPs that have a StateRAMP security status, StateRAMP-approved third-party assessment organizations (3PAOs) and providers with FedRAMP authorization.

As of publishing time, 17 FedRAMP 3PAOs have registered to also be StateRAMP 3PAOs, a reciprocity that the new organization offers.

“States have cybersecurity frameworks for their internal operations, but the extension of those through the procurement process to vendors on an ad hoc basis is very difficult, and that’s where StateRAMP comes in,” said Ted Cotterill, Indiana’s state chief privacy officer and StateRAMP board member. “I think what it offers us in state government is this collective approach, both within our state through this uniformity at the agency level or at the contract level, but then across the country, by putting states on this very solid footing with respect to CSPs and all of the cyber risk management concerns that flow from those relationships.”

The standardization benefits CSPs, too, said J.R. Sloan, Arizona’s CIO and a StateRAMP board member. In Arizona, his office has stood up resources to function as a 3PAO to the vendors the state and its local governments work with -- a costly and time-consuming endeavor. “I think it will be tough for states to continue to invest in their own monitoring and verification processes when there’s something like this that’s available,” Sloan said.

Bielawski said FedRAMP has been a huge help to federal agencies, but its requirements limit the vendors that can participate. For example, FedRAMP requires that a company do business with an agency within 12 months. StateRAMP does not have that stipulation.

“Vendors that don’t do a lot of business with the U.S. government but do a lot of business with state and local governments will now have the opportunity to go through … StateRAMP,” said Johann Dettweiler, director of operations at TalaTek. A FedRAMP 3PAO, the company announced Feb. 17 its status as a StateRAMP 3PAO.

StateRAMP authorization will require CSPs to go through a readiness assessment – a high-level view of the system that a 3PAO must perform, Dettweiler said. Whereas a full initial assessment takes eight to 12 weeks, this process will take two to four. At the end, the assessor determines whether a company would likely pass a full assessment. FedRAMP also has a readiness assessment, but it’s required only when providers go through a provisional authorization through the Joint Authorization Board.

The cloud service providers now have a “verify once, use many” standard that they can work from, Bielawski said. Before, “I didn’t know what I didn’t know. If I had had a StateRAMP organization that had guidance, mentorship and [quality assurance], teams of people with various levels of your certification process to answer questions just as a sounding board, it would have saved so much time, money and false starts.”

Although state and local governments have different security and cloud policies in place, they are fundamentally alike, Sloan said.

“While there may be nuances from a policy perspective, the common ground is there,” he said. “We’re [making] allowances for that, where there can be a Low-plus or a Moderate-plus approach to data classification and the type of controls. If any government entity has something that is special and unique to them, there’s a construct to be able to deal with that, recognize it and identify it but still minimize the burden on both the state and the vendor from a compliance and monitoring perspective.”

Using NIST’s Cybersecurity Framework as a basis helped, too, McGrath said. “That gave us a place to start so that we can have a standardized approach to these different impact levels, but to allow the flexibility when needed,” she added. “That’s how we’ve tried to adapt the controls and make it work for state and local government.”

The board and steering committee members expect wide interest in StateRAMP for several reasons. One is that many agencies have hastened their cloud adoption in response to the COVID-19 pandemic. Although there’s work to be done assessing companies on the front end, “on the backend, it’s going to be much faster because once the organization receives its StateRAMP accreditation, then all those other states and the local and state governments within the state itself as well as any of the other 49 states will be able to look at the StateRAMP Marketplace and say, ‘Yes, this cloud service provider has gone through the process,’” Dettweiler said.

Additionally, StateRAMP reduces negotiation friction in contacts and allows a single point of contact to vendors in the event of a cyber incident, Cotterill said.

“All of that frees up state resources,” he said. “We’re expected, as governments, to do more with less. We have to mitigate these risks with often fewer resources actually assigned to do that…. In state government, we’re stewards of the people’s information, and we have to get it right. StateRAMP makes it easy.”