Document Library

Get Started with GovRAMP

If you are new to GovRAMP or looking to understand how requirements are applied, start with these foundational resources.

These documents provide a practical starting point and help you understand how controls, requirements, and assessment expectations are structured across the GovRAMP program.
Security Assessment Framework
View SSP

Adopted Policies and Program Documents

Below, you’ll find policies and standards recommended by the Standards & Technical Committee and formally adopted by the GovRAMP Board of Directors that define security requirements and program expectations.
Quick Start:
How It’s Used:
Applies To:
Last Updated: September 20, 2025
Security Assessment Framework

This framework explains the end‑to‑end process service providers follow to complete a GovRAMP security assessment under Rev. 5. It serves as a shared roadmap for service providers and 3PAOs, outlining key steps, roles, and expectations to support a clear, consistent path to authorization.

Download
Last Updated: September 20, 2025
System Security Plan (SSP)

The System Security Plan (SSP) defines how security control responsibilities are allocated across a service provider’s system under GovRAMP Rev. 5. It helps clarify which controls are implemented by the service provider, inherited from underlying platforms, or shared with customers. Service providers use the OCM as part of their System Security Plan to document control implementation, while 3PAOs and government stakeholders reference it to understand responsibility boundaries, support assessments, and inform authorization and ongoing monitoring decisions.

Download
Last Updated: February 4, 2025
GovRAMP Core Controls

Defines the 60 prioritized security controls required to achieve GovRAMP Core verification. The controls are derived from NIST SP 800‑53 Rev. 5 and aligned with the Moderate Impact baseline, helping providers understand Core‑level expectations and prepare for PMO‑led review.

Download
Last Updated: December 17, 2025
GovRAMP CJIS-Aligned Overlay Control and Parameters

Download the GovRAMP CJIS-Aligned Overlay to access a unified framework aligning CJIS Policy 6.0 with GovRAMP controls, offering tailored guidance for secure cloud procurement decisions.

Download
Last Updated: July 2, 2025
Security Snapshot Controls Matrix

This matrix defines the control criteria used to generate a Security Snapshot of a service provider’s system. It offers a quick, high‑level view of security posture and explains how snapshot scoring is calculated based on implemented controls and associated risk.

Download
Last Updated: July 2, 2025
Progressing Security Snapshot Controls Matrix

This matrix defines the control criteria used to generate a Progressing Security Snapshot of a service provider’s system. It provides a high‑level view of security posture by outlining which controls are in place and how snapshot scoring is calculated based on implementation and risk.

Download
Last Updated: January 1, 2026
GovRAMP Progressing Security Snapshot Program Requirements and Progressing Improvement Guide

This guide outlines the requirements, roles, and processes for participating in the GovRAMP Progressing Security Snapshot Program. It explains snapshot assessment expectations, progressing improvement activities, and continuous monitoring responsibilities, providing service providers, assessors, and government stakeholders with a clear view of how security posture is measured and advanced over time.

Download
Last Updated: February 16, 2026
Service Provider Package – Low Impact

This package supports GovRAMP Ready and Authorized verification at the Low Impact level by defining the required templates and guidance used during a security review. Service providers use it to prepare and submit their product for review, while 3PAOs and government stakeholders can reference it to understand documentation expectations and how baseline security requirements are demonstrated for lower‑risk government systems.

Download
Last Updated: February 16, 2026
Service Provider Package – Moderate Impact

This package supports GovRAMP Core, Ready, and Authorized verification at the Moderate Impact level by defining the required templates, guidance, and documentation used during a security review. Service providers use it to prepare and organize their security materials, while 3PAOs and government stakeholders can reference it to understand documentation expectations and how Moderate Impact security requirements are demonstrated for systems handling more sensitive government data.

Download
Last Updated: February 16, 2026
Service Provider Package – Moderate Impact with CJIS Overlay

This package supports GovRAMP Core, Ready, and Authorized verification at the Moderate Impact level for service providers supporting criminal justice information (CJI). It defines the required templates, guidance, and documentation used during a security review, incorporating CJIS‑aligned requirements alongside standard Moderate Impact controls. Service providers use it to prepare consistent documentation and demonstrate how their systems protect sensitive law enforcement data, while 3PAOs and government stakeholders can reference it to understand CJIS‑specific security expectations and review requirements.

Download
Last Updated: February 16, 2026
Service Provider Package – High Impact

This package supports GovRAMP Ready and Authorized verification at the High Impact level by defining the required templates, guidance, and documentation used during a security review. Service providers use it to organize detailed security materials and demonstrate how their systems protect highly sensitive government data, while 3PAOs and government stakeholders can reference it to understand the rigorous security expectations required for systems where confidentiality, integrity, and availability are critical to government operations.

Download
Last Updated: February 16, 2026
3PAO Package – Low Impact

This package supports GovRAMP Ready and Authorized verification at the Low Impact level by defining the templates, assessment guidance, and required materials used by 3PAOs during a security review. It helps assessors perform consistent, structured evaluations aligned with GovRAMP’s NIST‑based framework and validate baseline security practices for lower‑risk government systems.

Download
Last Updated: February 16, 2026
3PAO Package – Moderate Impact

This package supports GovRAMP Core, Ready, and Authorized verification at the Moderate Impact level by defining the standardized templates and assessment guidance used by 3PAOs during a security review. It helps assessors conduct consistent testing, document results, and validate security controls for systems handling more sensitive government data.

Download
Last Updated: February 16, 2026
3PAO Package – Moderate Impact with CJIS Overlay

This package supports GovRAMP Core, Ready, and Authorized verification at the Moderate Impact level for environments that handle criminal justice information (CJI). In addition to standard Moderate Impact requirements, it incorporates CJIS‑aligned expectations to help 3PAOs verify appropriate safeguards for law enforcement data while maintaining consistent documentation and reporting practices.

Download
Last Updated: February 16, 2026
3PAO Package – High Impact

This package supports GovRAMP Ready and Authorized verification at the High Impact level by defining the comprehensive templates, testing guidance, and reporting materials used during a security review. It helps 3PAOs conduct thorough evaluations and validate critical security controls for systems where confidentiality, integrity, and availability are essential to government operations.

Download
Last Updated: August 7, 2024
Authorization Boundary Guidance

This guidance explains how to define a system’s authorization boundary for a GovRAMP security review. It helps service providers, 3PAOs, and government stakeholders determine which components, services, and connections are in scope for assessment, supporting clear authorization decisions aligned with GovRAMP Rev. 5 requirements.

Download
Last Updated: June 8, 2026
Authorization Boundary Diagram Checklist and Example

This document outlines the key requirements to be validated to ensure the authorized boundary meets the criteria for acceptance of the security package submission. This accompanies the Authorization Boundary Guidance. 

Download
Last Updated: June 6, 2023
Penetration Test Guidance

This guidance outlines the requirements and best practices for conducting penetration testing as part of a GovRAMP security assessment. It helps service providers and assessors ensure testing is properly scoped, aligned with Rev. 5 controls, and effective at identifying potential vulnerabilities before and after authorization.

Download
Last Updated: June 1, 2026
Continuous Monitoring Guide and Escalation Process

Provides instructions on how CSPs should continuously monitor their systems after authorization to maintain alignment with GovRAMP Rev. 5 standards. The guide outlines monitoring activities, reporting requirements, and escalation processes for addressing issues identified during continuous monitoring to support ongoing security and timely risk management. This document combines the Continuous Monitoring and Improvement Guide with the Escalation Process Guide.

Download
Last Updated: April 13, 2026
Continuous Monitoring Matrix Template Completion Guide

This document provides guidance on completing the GovRAMP Continuous Monitoring Matrix template in support of achieving and maintaining a security authorization that meets GovRAMP requirements. 

Download
Last Updated: August 30, 2024
Vulnerability Scan Requirements Guide

This guide defines the requirements for conducting regular vulnerability scans of systems under GovRAMP. It helps service providers and assessors understand scanning frequency, scope, and reporting expectations, supporting proactive identification and remediation of security weaknesses in alignment with Rev. 5.

Download
Last Updated: August 30, 2024
Incident Communications Procedures

This document outlines the required procedures for communicating with GovRAMP and relevant stakeholders following a security incident. It supports timely, coordinated response efforts by clarifying notification triggers, communication timelines, and roles in alignment with GovRAMP Rev. 5 standards.

Download
Last Updated: December, 2025
Procurement Cloud Security Resource Tool

Developed by the NASPO/GovRAMP Procurement Task Force, this tool shows how procurement, IT, and risk teams can work together throughout the cloud procurement process. It promotes a coordinated, shared approach to security decision‑making, helping agencies move away from siloed workflows and ensure cybersecurity is considered at every stage.

Download
Last Updated: April 2026
GovRAMP Federal Overlay

This overlay was developed by GovRAMP in collaboration with security experts and government stakeholders to align GovRAMP Low, Moderate, and High Impact Level requirements with common federal requirements, including FedRAMP Rev. 5 Low, Moderate, and High Impact Level standards under NIST SP 800‑53 Revision 5. This alignment helps service providers with assessing and implementing controls that satisfy both state and federal expectations, reducing duplication and accelerating authorization.

Download

Guides, Resources, and Supporting Materials

Below, you’ll find educational resources, templates, and guidance designed to help service providers understand and implement GovRAMP requirements.
3PAO Accreditation Process Guide

A brief guide explaining the standards and requirements for 3PAOs to become accredited to perform independent cybersecurity assessments for GovRAMP.

Download
Appeals Committee Charter

The Appeals Committee serves as the adjudication board for the Program Management Office determinations.

Download
Approvals Committee Charter

This charter outlines the duties and responsibilities of the GovRAMP Approvals Committee and their role in providing approvals for product security packages seeking an Authorized status.

Download
Authorization Annual Assessment Controls Selection Workbook

This comprehensive workbook is designed to support 3PAOs and service providers with Provisional or Authorization in tracking audits and maintaining compliance with GovRAMP requirements.

Download
CDG Cloud Procurement Guide

A comprehensive best‑practice guide for state and local governments on procuring cloud and as‑a‑service solutions, including standardized contract terms, NIST SP 800‑53–aligned security and privacy controls, data management requirements, breach notification rules, personnel and access safeguards, audit and continuous monitoring expectations, and model clauses for SaaS, PaaS, and IaaS procurements.

Download
Cybersecurity 101: Understanding Risk and Resilience

This eBook compiles GovRAMP’s Back to the Basics series into a single guide for public-sector teams and providers. It covers twelve foundational cybersecurity concepts — from understanding risk, vulnerabilities, and data integrity to strengthening privacy, policy, and compliance practices.

Download
Data Classification Tool

This document provides instructions for using the GR-199 worksheet to identify data types, review impact levels, and determine the appropriate GovRAMP security category for a product.

Download
GR-199 — Data Classification Determination Tool

This tool helps service providers and governments determine the appropriate GovRAMP security impact level for a product based on the types of data it processes, stores, or transmits.

Download
December 2025 Progress Report: Insights From The Progressing Security Snapshot Program
Download
GovRAMP Adopted Bylaws

The official governing rules for StateRAMP (GovRAMP), outlining its purpose, membership structure, board authority, officer roles, and operational procedures as an Indiana nonprofit.

Download
GovRAMP CJIS-Aligned Overlay Control and Parameters

Download the GovRAMP CJIS-Aligned Overlay to access a unified framework aligning CJIS Policy 6.0 with GovRAMP controls, offering tailored guidance for secure cloud procurement decisions.

Download
GovRAMP PMO Charter

The PMO Charter defines the objectives, roles, and responsibilities associated with the GovRAMP Program Management Office (PMO).

Download
GovRAMP PMO Fee Schedule

This document provides an updated GovRAMP Program Management Fee Schedule, effective January 1, 2025.

Download
Procurement Committee Charter

The purpose of this charter is to define the objectives, membership, decision making, meeting schedule, and roles and responsibilities associated with the GovRAMP Procurement Committee.

Download
Progressing Security Snapshot Progressing Improvement Escalation Process

Outlines requirements for Progressing Snapshot participants, including quarterly improvement, evidence refresh, advisory calls, and conditions for compliance or withdrawal.

Download
Ready Minimum Mandatory Requirements for Moderate and High Impact Levels

Defines the minimum mandatory security requirements a Service Provider must meet to achieve GovRAMP Ready at the Moderate or High Impact levels. These requirements establish the baseline controls, documentation, and security practices—aligned with NIST SP 800‑53 Rev. 5—that a 3PAO must validate in the Readiness Assessment Report (RAR).

Download
Service Provider Sponsor Requirements

This document outlines the process (including government sponsorship requirements) for a vendor’s offering to be listed as GovRAMP Authorized on GovRAMP’s Authorized Product List (APL).

Download
Standards & Technical Committee Charter

The Standards & Technical Committee makes recommendations for best practices and policies that guide cloud security requirements and verification.

Download
Steering Committee Charter

The purpose of this charter is to define the objectives, membership, decision making, meeting schedule, and roles and responsibilities associated with the GovRAMP Steering Committee.

Download

Subscribe for Document Updates

Be the first to know when new GovRAMP documents, templates, or policy updates are released. Subscribe to receive email notifications and stay aligned with the most current program materials.