Skip to main content

    Free framework self-check

    StateRAMP Self-Check

    StateRAMP now operates as GovRAMP. If a state, local or education customer asks about the security status of your cloud service, this free self-check can help you prepare the first questions. Ten questions cover the service boundary, security controls, documentation and ongoing monitoring. They do not award a program status or establish that a customer will accept your service.

    The risk
    The tool suggests possible gaps from your answers. It does not verify controls or provide an audit, certification or legal advice.
    Start the StateRAMP self-checkTalk to us
    a readiness gap register beside a bundle of sampled control-testing evidence.

    How the self-check works

    1. You give a first name, company and work email. Your session is stored and a resume link is sent by email.
    2. An external AI service uses your intake details to draft ten questions about the framework. You answer in your own words; no documents are uploaded.
    3. You receive a short summary of potential gaps and a suggested order of work, based only on your answers.
    4. Use the summary to discuss open questions with your team. If you need a professional review, contact us before sharing records or confidential information.

    The summary comes from your answers, not a review of your systems. It cannot be used as an audit or certification result.

    Who it is for

    Cloud providers selling to state, local and education customers that require StateRAMP or GovRAMP participation. It is useful for product, security and public-sector sales teams planning their first review. Start with the customer's actual procurement requirements and one named service offering. Different customers may have different acceptance conditions, even when they use the same program.

    GovRAMP preparation for public-sector cloud services

    The five themes covered

    Boundary and impact level selection
    Which service components and data types need to be considered, and what impact level fits the offering. Think about external connections and support access. A clear boundary helps the team understand both its responsibilities and inherited protections.
    Control implementation and inheritance
    How your team implements the relevant security requirements and relies on other providers. Consider what the underlying infrastructure supplies and what remains your responsibility. Documenting an inherited control does not make an unimplemented application control disappear.
    Documentation and security snapshot readiness
    Whether the security documentation reflects the current offering and supports the program step you intend to pursue. Consider the system security plan, diagrams, policies and available records. A Security Snapshot and a verified security status are different outcomes.
    Continuous monitoring
    How the service maintains its security information, reviews changes and follows up vulnerabilities. Consider who owns recurring tasks and what happens when deadlines are missed. A preparation exercise should account for ongoing work, not only the first submission.
    Sponsorship and the PMO process
    Who coordinates with government customers, assessors and the program management office. Consider the participation and sponsorship requirements for the status sought. Confirm the current process with GovRAMP before committing to a schedule or promising a procurement outcome.

    From self-check to assessment

    A professional gap assessment can examine selected NIST SP 800-53 controls and the documentation behind your answers. For example, your hosting provider may supply security records while your own incident-response responsibilities remain undocumented. We help your team identify preparation work. FedRAMP experience may be useful, but requirements, review processes and customer acceptance should be checked separately.

    AuditPartners helps with preparation. Program-recognized assessors and GovRAMP handle official review and status decisions; the purchasing organization determines whether the offering meets its procurement requirements.

    Guides and assessment services

    The next step

    Start the StateRAMP self-check

    Ten questions, answered in your own words. Sessions are stored so you can resume; session pages are not indexed.

    Start the self-checkTalk to us