GovRAMP

1. 2026-09-22 Medium
   GovRAMP releases phishing-resistant MFA requirements guide for Moderate and High impact systems

   GovRAMP has released a quick-reference guide outlining phishing-resistant multi-factor authentication requirements for systems classified as Moderate and High impact. The guide specifies applicable authentication assurance levels …

   Guidance Action required

2. 2026-09-22 Medium
   GovRAMP releases guidance on phishing-resistant MFA compliance requirements

   GovRAMP has released comprehensive guidance to help Service Providers understand and implement phishing-resistant MFA requirements under GovRAMP Rev. 5. The guidance clarifies which authentication methods meet …

   Guidance Action required

That is the last 90 days. Sign in to read further back.

1. 2026-07-24 GovRAMP published an AI Self-Reporting Addendum for providers to disclose the architecture, data use, governance, controls, risks and limitations of AI-enabled products
2. 2026-07-15 Updated FedRAMP Class A Certification Rules recognise GovRAMP as an approved alternative security framework
3. 2026-04-17 GovRAMP published a Federal Overlay for the Low, Moderate and High impact levels, aligned with common federal security requirements

1. 2026-03-18
   Rev 5 templates for Low, Moderate and High (March 2026) RevisionCurrent

   Updated Low and Moderate authorization templates (including the Moderate CJIS overlay packages), added new High Impact templates and a Continuous Monitoring Matrix completion guide. source

A verification programme for cloud providers serving public sector customers, built on NIST SP 800-53 Rev. 5.

Basis

GovRAMP is built on NIST SP 800-53 Revision 5 and follows a "verify once, serve many" model for governments verifying cloud products. source

Impact levels

Providers pick the Low, Moderate or High impact level based on their government customers and data sensitivity, and use the matching Service Provider Package. source

Core

Core Verification checks 60 foundational controls aligned to NIST SP 800-53 Rev. 5 and the Moderate baseline, assessed by the GovRAMP PMO without an immediate 3PAO assessment. source

Procurement

GovRAMP provides sample procurement language and templates for governments that want to include its requirements in an RFP. source

Texas

TX-RAMP recognises GovRAMP through reciprocity, so a GovRAMP Verified status can be reused for Texas compliance. source

Authorized status needs a 3PAO assessment and government or committee approval, followed by continuous monitoring with annual 3PAO assessments.

Verification levels

The Authorized Product List shows Core, Ready, Provisionally Authorized and Authorized statuses; Authorized is the highest. source

Authorized

Authorized needs a complete Security Assessment Report from a 3PAO and approval by a government sponsor or the GovRAMP Approvals Committee. source

Continuous monitoring

Verified providers submit monthly and quarterly security reports to the PMO, conduct annual 3PAO assessments and remediate POA&M items on set timelines. source

Security Snapshot

The Security Snapshot scores a product against a subset of NIST SP 800-53 Rev. 5 controls mapped to Ready; GovRAMP recommends refreshing it annually. source

GovRAMP status is kept through continuous monitoring; governments enforce it through their procurement requirements.

Keeping status

Following authorization, the product enters continuous monitoring to maintain ongoing compliance with GovRAMP requirements. source

Contracts

Governments can write GovRAMP requirements into RFPs and cloud contracts using GovRAMP's sample language. source

1. Guidance GovRAMP Changelog
2. Template GovRAMP Document Library
3. FAQ GovRAMP FAQs
4. Guidance Authorized and Provisional Verification
5. Guidance Core Verification

1. FedRAMP

   FedRAMP is GSA's programme for cloud services used by federal agencies; GovRAMP is a nonprofit programme for state and local government, recognised in FedRAMP's Class A rules.

2. TX-RAMP

   TX-RAMP is Texas's own state programme; it accepts GovRAMP verification through reciprocity.

3. CJIS Security Policy

   The CJIS Security Policy is the FBI's requirement for criminal justice information; GovRAMP offers Moderate packages with a CJIS overlay.

4. NIST SP 800-53

   NIST SP 800-53 is the control catalogue; GovRAMP selects Rev. 5 controls into its Core, Snapshot and impact-level requirements.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to GovRAMP (RSS)