Why StateRAMP works for state and local cloud procurements

Following the lead of the federal government and its Federal Risk and Authorization Management Program (FedRAMP), a group of state IT officials and vendors launched StateRAMP in early 2020. Designed to advocate for strong security standards for authorized infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS) and software-as-a-service (SaaS) providers, it eases the procurement process for both state and local governments and academic institutions.

Through the program, state and local governments receive unbiased validation that StateRAMP-authorized cloud solutions are secure and capable of safely storing government and citizen data. For cash-strapped public sector organizations, the program can help streamline modernization and cloud decision-making, allowing previously overwhelming decisions to become achievable.

As state and local governments prepare to take advantage of StateRAMP, IT leaders can increase the value derived from cloud solutions by working collaboratively in partnership with industry, taking steps to prepare to utilize StateRAMP and fully leveraging cloud technologies.

Working together

Public-private collaboration is key to successful IT modernization and elevated by StateRAMP’s approach. Without StateRAMP, each state would rely on its own process for procurement, security authorization and onboarding of cloud vendors. This can lead to a fragmented, inefficient process, ripe for potential vulnerabilities.

StateRAMP supplies a common security framework so state and local CIOs can easily find and access secure cloud solutions that will help hasten the information flow between departments, create operational efficiencies and consequently inform policy for citizens.

Having a common security framework with StateRAMP gives decision-makers the confidence that cloud service providers have the level of security necessary to meet their requirements and can enhance their organization’s overall cybersecurity posture. In addition, the documentation and audit process developed with leading private-sector IT providers helps ensure the latest cloud-based solutions are compliant with state and local government regulations, leading to faster digital transformation and operational efficiency. In order to receive StateRAMP authorization, vendors must have a pre-requisite level of cyber protection in their products. That means decision-makers, security specialists and procurement teams can make decisions faster with the assurance of StateRAMP.

The StateRAMP program also greatly accelerates the acquisition process by creating a common language around procurement to guide decision-makers and procurement teams through the complex matrix of cloud and cyber. This process can often be fragmented between state and local government.

States that adopt StateRAMP may have additional security requirements, which present a challenge. Sometimes these additional requirements are necessary because of the sensitivity and types of information being protected, such as health or tax records, and sometimes it is a result of legacy, on-prem architects, engineers and security specialists. In those cases, state agencies must determine if StateRAMP provides a sufficient level of cyber assurance or not. In cases where additional cyber protocols are needed, however, StateRAMP will still give these organizations with a strong cyber baseline to work from.

The key is that StateRAMP establishes not only a baseline level of cyber assurance, but also a baseline level of trust between public and private organizations. Agencies that view StateRAMP as a foundational piece of their cloud procurement strategies will have a quicker and easier time procuring cloud products and can focus, therefore, on more strategic elements such as fit-to-strategy, architectural fit, total cost of ownership and, ultimately, transparency and simplicity in licensing.

Preparing for StateRAMP

State and local governments can take several steps to prepare themselves to benefit from StateRAMP.

This starts with naming stakeholders and deciding on a governance process, gathering current contract information for the StateRAMP Data Discovery form, and developing and adopting a security policy. All suppliers using an IaaS, PaaS or SaaS solution to process, send or store government data should be compliant and verified by StateRAMP.

As agencies are selecting new vendors, naming the security status requirements necessary for procurement will be key. StateRAMP will give information on the different security statuses, and the government must decide which security status to require at the time of an RFP and upon contract initiation.

What’s crucial is that state and local governments can determine security requirements for the information each of their cloud solutions will manage and fully consider these needs in their decision-making process. First, state and local governments should take the time to understand what StateRAMP does for their cyber and procurement processes — where things will be streamlined and where there may be additional work involved. Next, organizations should be cognizant of any additional requirements that may be needed that are above and beyond what StateRAMP requires and incorporate those additional items into the procurement process accordingly. Lastly, government leaders should understand and acknowledge the influence that legacy systems and teams may have on the adoption of StateRAMP and implement an appropriate change management approach. StateRAMP can be an opportunity for state and local governments to assess their cloud procurement processes and cyber posture and determine how StateRAMP can benefit them and what processes or technology may no longer serve the mission.

Integration is key

Governments looking to use StateRAMP should already be thinking about the applications they would like to move into the cloud and how to get the most from them. As they make these determinations, they should also consider how they could benefit from integrating their cloud platforms to increase an application’s functionality.

Government IT managers can use integration platform as a service solutions to seamlessly combine and connect data from disparate systems and resources. iPaaS solutions can integrate cloud-to-cloud, cloud-to-on-premises and on-premises-to-on-premises platforms, connecting all types of public sector resources.

As a result, public sector organizations can connect better with their constituents through applications ranging from chatbots to interactive portals that can quickly supply necessary information from the cloud. For the public sector workforce, iPaaS solutions streamline processes like onboarding and access to important internal resources.

The StateRAMP Vendor List, first released this past September, is a crucial step to ensuring common security criteria among cloud vendors. By working hand in hand with industry, planning strategically to make use of cloud solutions through StateRAMP and maximizing the benefit of each cloud investment, state and local governments can vastly improve employee and citizen experiences and better serve their constituents.