STATERAMP + GovRAMP are FedRAMP-aligned authorization programs for state + local + tribal governments. STATERAMP (https://stateramp.org/) - non-profit organization + administers state-government cloud authorization mirroring FedRAMP processes + uses FedRAMP-compatible baselines (Low + Moderate + High) + adopts 3PAO assessment. GOVRAMP (https://www.govramp.org/) - similar program targeting cross-jurisdictional government cloud authorization. RECIPROCITY: CSPs with FedRAMP Moderate or High authorization are typically eligible for StateRAMP / GovRAMP fast-track + the M-24-15 modernization emphasises reciprocity. CROSS-AUTHORIZATION PATHWAYS: CSPs may pursue FedRAMP first + then leverage to StateRAMP / GovRAMP + vice versa. The Cybersecurity Maturity Model Certification (CMMC) for DOD contractors is separate but coordinates with FedRAMP through the DOD JAB review of FedRAMP-authorized CSPs serving DOD agencies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.