You do not have to move your application and your customers' data into another company's cloud to get FedRAMP or GovRAMP. Keep your system where it is. Enablement® produces the evidence inside your own boundary, from your own live scans, and the certification and the Marketplace listing are in your own company's name.
They are two separate programs. GovRAMP, formerly StateRAMP, covers state and local governments and public universities. Holding one does not mean the other side will accept you.
If you sell to both, plan for both: FedRAMP 20x for federal buyers and a GovRAMP status for the states. Both rest on NIST 800-53, so most of the evidence you prepare for one serves the other.
Machine-readable VDR/VER vulnerability reporting is required of every certified offering.
Most other requirements of FedRAMP's Consolidated Rules take effect.
FedRAMP stops accepting new Rev5 certifications.
The platform and its scanning stack install inside your existing boundary, as part of your system.
Evidence collection is activated for all 46 Key Security Indicators and your boundary is described in the 20x document set.
CR26 artifacts assemble continuously from your own scan data: schema-validated, current, and re-runnable.
Your 3PAO works from live evidence endpoints. We provide assessor liaison through the assessment and refer assessors at no cost.
Submission does not wait on a six-month monitoring history: under the published rules, mechanisms in place plus a written commitment satisfy that requirement at initial certification.
$7,500 one-time
$48,000 one-time
$2,500 /month per offering
| Also | Cost |
|---|---|
| Rev5 → 20x Migration, Class B (Low) | $19,500 one-time |
| Class B → Class C upgrade, any time later | $28,500 one-time, the exact difference between the two migration fees. Starting at Low carries no penalty. |
| Class D (High) migration | Quoted individually |
| 3PAO referral | No charge. Referred assessors have committed pricing against the reduced 20x verification workload. |
How these costs compare with consultants and GRC platforms →
Our offering is listed on the FedRAMP Marketplace under the 20x track, and our 3PAO assessment runs on the same artifacts this pipeline generates for you.
GovRAMP, formerly StateRAMP, is the cloud security program that state and local governments and public universities use. A nonprofit runs it, and it is built on NIST 800-53, the same controls as FedRAMP. Each government decides whether to require it.
It depends on the state. North Carolina accepts FedRAMP Rev5 in place of GovRAMP and does not permit authorizations from the 20x pilot. Nevada asks a Rev5 holder to start GovRAMP Fast Track within 30 days of award. Read the buyer's own policy before you rely on one certificate for both markets.
Enablement produces NIST 800-53 evidence inside your boundary, and both programs are built on those controls. The independent assessment and the review for GovRAMP are performed by GovRAMP's assessors and its program office.
The modern FedRAMP certification type. Instead of a documented control baseline assessed by prose review, offerings are assessed against measurable Key Security Indicators (KSIs), with machine-readable packages and continuous validation between reviews.
Under the Consolidated Rules for 2026, machine-readable VDR/VER vulnerability reporting is required by December 7, 2026, and most other CR26 requirements take effect January 1, 2027.
A Key Security Indicator: a measurable statement about your security posture that can be validated with evidence, ideally automated. Your 3PAO verifies the evidence methods instead of manually assessing each area from documents.
No, the opposite. Enablement deploys inside your existing boundary as part of your system, and the authorization remains yours. This is the structural difference from boundary-hosting platforms, where your product moves into someone else's authorized environment.
No. Scanning, evidence generation and report assembly all run inside your boundary. There is no external SaaS receiving your telemetry.
Listing FR2628647239 on the FedRAMP Marketplace: 20x track, Class C (Moderate), Initial Implementation phase, with 3PAO assessment underway. The Marketplace listing is the authoritative source for current status.
See your real KSI readiness picture before December, with no data leaving your boundary.
Deterministic helper: every answer here is authored and approved, never AI-generated. That is rather the point.