StateRAMP

State government cloud security: software component inventory, supply chain documentation.


Region	Americas
Country or scope	United States
Sector	Cloud
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers StateRAMP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for StateRAMP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for StateRAMP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`STRAMP-CM-8` System Component Inventory	Providers must maintain an accurate inventory of the components of the authorized system, per the CM-8 control incorporated into StateRAMP baselines (StateRAMP baseline: NIST SP 800-53r5 CM-8)	Scan
`STRAMP-RA-5` Continuous Vulnerability Scanning	Continuous monitoring requires monthly vulnerability scanning, which depends on components carrying identifiers matchable to vulnerability databases (StateRAMP continuous monitoring: NIST SP 800-53r5 RA-5)	Scan
`STRAMP-SR-4` Supply Chain Documentation	Providers must document the provenance of system components, including who produced the supply chain documentation itself (StateRAMP baseline: NIST SP 800-53r5 SR-4)	Scan
`STRAMP-SR-3` Supplier Identification	Supply chain risk management processes require identifying the suppliers of system components (StateRAMP baseline: NIST SP 800-53r5 SR-3)	Scan
`STRAMP-SI-7` Software Integrity	Integrity verification of software must be supported, requiring hashes for the components in the deployed system (StateRAMP baseline: NIST SP 800-53r5 SI-7)	Scan
`STRAMP-SI-2` Flaw Remediation Data	Timely flaw remediation obligations require version data for all system components so patch applicability can be established (StateRAMP baseline: NIST SP 800-53r5 SI-2)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SRMP-AC-2`	Account management for state government cloud services
`SRMP-CA-2`	StateRAMP security control assessment
`SRMP-IR-6`	Report incidents to state CISO and StateRAMP PMO
`SRMP-SC-28`	Encrypt state government data at rest
`SRMP-RA-5`	Monthly vulnerability scanning for StateRAMP
`SRMP-CONMON`	StateRAMP continuous monitoring and reporting
`SRMP-AT-2`	Security awareness training for state data handlers
`SRMP-SA-9`	Manage subcontractors handling state government data
`SRMP-PL-8`	Maintain StateRAMP System Security Plan

Policy templates

Written for StateRAMP:

StateRAMP Authorization and Cloud Procurement Policy
State Government Data Classification and Cloud Handling Policy
StateRAMP Vendor Management and Annual Review Policy

And 22 from the standard set, adapted to StateRAMP.