StateRAMP launches early assessment program
ipopba/Getty Images
Connecting state and local government leaders
With the Security Snapshot, governments can understand the current maturity of a cloud product’s security, and providers get insights to help them achieve StateRAMP Ready or Authorized status.
Next month, StateRAMP will begin offering a new early-stage security maturity assessment tool for cloud vendors.
Called the StateRAMP Security Snapshot, the nonprofit that helps state and local agencies find vetted cloud products is billing it as a “pre-Ready” measurement and gap analysis. The program assigns scores so government customers and cloud providers can see where products are in terms of meeting the minimum mandatory StateRAMP Ready requirements. Those include compliance with the National Institute of Standards and Technology’s Special Publication 800-53 on security and privacy controls for information systems.
The tool grew out of questions from providers and government officials about how to begin the StateRAMP authorization process.
From agencies, “the question that we’ve heard is, ‘How can I assess whether a provider is going to be able to achieve a StateRAMP Ready, that they’re making progress toward that status?’” said Leah McGrath, executive director of StateRAMP. As more agencies look to secure cloud solutions, governments will begin “incorporating the StateRAMP Security Snapshot as a requirement for bidders to respond to solicitation,” she said. That insight will “give them a kind of an apples-to-apples comparison of the cyber maturity of these products related to NIST 800-53.”
Agencies can then require vendors they contract with to become StateRAMP Ready or Authorized within a stated period of time, McGrath said.
StateRAMP reviewed other security assessments and incorporated some of those requirements into the Security Snapshot so that providers could build on what they’ve already done, she said. Examples of include security operations center audits and previous Federal Risk and Authorization Management Program assessments.
Vendors using the snapshot tool can share their scores at their discretion; StateRAMP is not making them public. One reason for that, McGrath said, is they’re like a practice test. “If you’re taking a practice test for your final exam, you don’t want that score to count because you’re trying to understand what do I need to work on,” she said. “It’s the final exam score that’s going to be public – or on your record.”
Plus, the snapshot is a moment-in-time assessment that is not reflective of a continuous monitoring program. Once products achieve one of three StateRAMP verified statuses, continuous monitoring begins. When that happens, “there’s continual reporting every month to our program management team, and that’s available to participating government agencies,” McGrath said.
Talk about the snapshot tool began in December 2021. For the past year, the StateRAMP board and committees had been discussing having a “pre-Ready” assessment to help providers understand where they stood in relation to being able to achieve StateRAMP Ready status and what gaps they needed to close, McGrath said. For its part, StateRAMP wanted “to be able to understand those gaps so that we can develop resources to help providers achieve StateRAMP Ready?” she said.
Providers can start the snapshot process by becoming a StateRAMP member – for $500 – and submitting an online form. Once the review is completed, the provider will receive a letter with the product’s maturity score.
Snapshot reviews will take about three weeks to complete, and StateRAMP recommends that a valid snapshot is not older than 12 months. Fees for the snapshot assessment will range from $500 to $1,500, based on a tiered structure.
Looking forward to 2023, McGrath said StateRAMP will update its requirements to incorporate NIST 800-53 Version 5. “That’s going to be a big task for our Standards and Technical Committee and for our members who will provide input into that process,” she said. “We’re also going to be working to harmonize the other frameworks that flow down as requirements to states and local governments, including CJIS, the Criminal Justice and Information System and HIPAA requirements.”
Stephanie Kanowitz is a freelance writer based in northern Virginia.