Three Accredited 3PAOs Join GovRAMP's Voluntary Discount Program

INDIANAPOLIS — July 22, 2026 — GovRAMP today announced that SecureIT, AARC-360 and RSM US LLP have joined its 3PAO Discount Program. The program allows participating accredited third-party assessment organizations (3PAOs) to offer discounts of up to 30% on independent security assessments for service providers that complete the GovRAMP Progressing Security Snapshot program or achieve GovRAMP Core verification. GovRAMP launched the voluntary program in April 2026. 

The addition of the three assessment organizations brings the total number of participating 3PAOs to 13. Their participation reflects continued recognition that service providers who prepare before a formal assessment often begin the process with stronger documentation, more mature security controls, and a better understanding of GovRAMP requirements. 

"Preparing before a formal assessment helps organizations identify and address gaps early," said Leah McGrath, executive director of GovRAMP. " Providers that invest in security readiness are often better prepared for the assessment process, and we're pleased to see more accredited 3PAOs recognize that work by participating in this program."

GovRAMP created the Progressing Security Snapshot program and Core verification to help service providers evaluate and strengthen their cybersecurity programs before entering a formal assessment. These programs give organizations a structured way to identify gaps, improve security practices, and better understand assessment expectations. 

Participating 3PAOs have reported that organizations completing these programs often require less rework during an assessment, helping create a more efficient process for both the service provider and the assessor. 

Participating 3PAOs

The GovRAMP 3PAO Discount Program includes the following accredited assessment organizations:

• 360 Advanced 

• A-LIGN 

• AARC-360 

• Coalfire 

• Data Lock Consulting Group 

• Fortreum

• Lunarline 

• Prescient Security 

• RISCPoint 

• RSM US LLP 

• Schellman 

• Securisea 

• SecureIT

Participating 3PAO Quotes

"We’ve spent enough years on the assessor side of the table to know that readiness isn't something a provider can manufacture in the last week before an assessment. That's exactly what we see from providers who've come through GovRAMP's Security Snapshot and Core programs — they arrive having already done the hard, unglamorous work. Extending them a discount isn't a giveaway; it's SecureIT recognizing they've already carried part of the load, and meeting them there so that doing security right costs less than doing it late." — Tim J. Sandage, Chief Growth Officer, SecureIT

“Providers that complete GovRAMP's Progressing Security Snapshot or achieve Core Verification begin the independent assessment process with a stronger understanding of their control environment, evidence requirements, and readiness gaps," said Neil Gonsalves, CEO of AARC-360. "That preparation helps organizations address issues earlier, reduces unnecessary rework, and supports a more efficient, high-quality assessment. AARC-360 is proud to participate in the GovRAMP 3PAO Discount Program and provide independent assessments that help qualified cloud service providers demonstrate security, transparency, and trust to government customers.” — Brian Fischer, Head of Sales and Marketing,  AARC-360 

About GovRAMP

GovRAMP is a nonprofit membership organization dedicated to advancing consistent, trusted cybersecurity practices across state, local, tribal, and educational government. Guided by its mission to make cybersecurity easier to understand, implement, and maintain, GovRAMP provides a standardized framework, independent validation, and community-driven education that help governments adopt secure cloud solutions with confidence while enabling service providers to demonstrate trusted security through clear, evidence-based practices. By bringing together public and private sector partners, GovRAMP supports policy collaboration, strengthens shared assurance, and helps build a more resilient cybersecurity ecosystem that protects government services, data, and the communities they serve. Learn more at GovRAMP.org.