FedRAMP vs StateRAMP Cost Comparison Guide

Cloud service providers looking to work with the government, whether it’s at the state and local level or at the federal level, will have to adhere to certain cybersecurity standards.

At the federal level, the program is called FedRAMP: the Federal Risk and Authorization Management Program. This program is required for all CSPs handling any sort of controlled or sensitive information for the government at the federal level, and is mandatory to win contracts to work with branches of the federal government.

At the state and lower level, there’s not a singular program in the same way. This is because while the federal government is one overall entity, states have 50 different governments, and each state has numerous local governments. Most of them are, to put it lightly, not on the same page.

Rather than hundreds of disparate sets of requirements, the dream of a centralized security standard similar to FedRAMP arose. The result was StateRAMP, a program modeled roughly after FedRAMP, but aimed at state governments, local governments, and educational administrations like universities and school districts.

StateRAMP is not as widely used as FedRAMP. It’s not present in every state, and in the states that use it, not every local government or organization uses it. You can see their map and list of participating groups here.

Of note, also, is the name. StateRAMP was a good name to compare to FedRAMP when it was primarily meant for state-level governments, but the expansion to local and educational groups made it less relevant. Last year, they renamed themselves to GovRAMP, as a more generalized name. The underlying organization and operations are the same, just the name has changed. We’ll use both terms throughout this post, just to make sure anyone looking for information on either one can find it.

In the past, we covered the similarities and differences between StateRAMP/GovRAMP and FedRAMP. One thing we didn’t touch on in that post, though, is cost. So, let’s talk about the costs of implementing and adhering to both programs today.

What Are the Costs of a RAMP Program?

There are a lot of costs related to either the FedRAMP or the GovRAMP program. The cost categories are similar across both, so it’s worth discussing them before digging into the specifics.

Costs can generally be broken down into official costs and unofficial costs.

Official costs are the costs you can’t avoid if you want to achieve an authority to operate with the government through either FedRAMP or GovRAMP. These are things like application fees, membership dues, and certification fees. They can’t be reduced or avoided if you want to get your security authorization. Auditing fees also fall into this category, though the specific costs of an audit can vary.

Unofficial costs are the costs associated with implementation. The costs of hiring consultants, of performing internal analyses and gap analyses to figure out what work needs to be done, the costs of actual implementation, the costs of tools and resources necessary to achieve that security, the costs of monitoring and maintenance; all of these apply to both kinds of programs.

Unofficial costs are much more variable. Some scale by the size of your CSP. Some can be avoided if you have in-house staff already capable of doing some of the work, or if you’ve already been using security at an appropriate level and just didn’t validate it. There are going to be unavoidable costs, of course, but they’re more adjustable.

Let’s compare the two programs in terms of each of these kinds of costs.

Costs of Self-Auditing and Gap Analysis

For many, the first stage of achieving FedRAMP or GovRAMP authorization is the self-analysis and auditing necessary to see what scale of work you have ahead of you. This involves a thorough inventory of your business and systems, classification of the information you handle, and an estimation of your current security posture according to the NIST guidelines used by both FedRAMP and GovRAMP.

Costs here vary a lot. On the low end, some analysis, auditing, and checklist-checking processes can be done for a few thousand dollars. A thorough gap analysis can be anywhere from $10,000 for smaller businesses and limited systems, up to $150,000 for larger businesses and more complex systems.

This is the same cost and process for both FedRAMP and GovRAMP, but GovRAMP is often (though not always) going to be on the cheaper end because the organizations seeking GovRAMP approval tend to be smaller than those seeking FedRAMP approval.

Costs of Implementing Security

The actual costs of implementing security to bring your organization up to the standards required of either GovRAMP or FedRAMP will vary dramatically depending on what needs fixing, to what extent, and how you go about it.

It also depends on the stringency of the security you need to reach. If you’re setting up to achieve level three security rather than level one, you’re going to have a lot more work to do, and the more work you have to do, the more expensive it’s going to be.

In tangible terms, the range is huge. Low-end implementation can range from $10,000 and up, while the more work you need to do and the more systems you have to secure, the more you can add. It’s not uncommon for implementation across the board to sum up to $250,000, $500,000, or even more. The largest organizations can spend millions on their overall security.

These costs are broken down across dozens of different line items. The costs of certificates, the costs of training, the costs of salaries for the security specialists working for you, the costs of hardened systems, and more all add up.

Costs of Security Tools and Resources

Security tools are another big area of expense, though it can often get broken up across other categories. Some of those tools are used for monitoring, for example, so that expense can be filed under the post-compliance monitoring expenses. Similarly, other tools relate to the self-auditing and remediation processes, and get filed under those expense categories.

A lot of this depends on how much work you’re doing in-house versus how much work you’re using third-party tools to do. Tools range from around $25,000 to $150,000 annually, depending on how many you need and which ones have ongoing subscription fees. You may also want to add in the salary of the people trained to use them, if they weren’t originally part of your team.

This is another area where the cost difference between GovRAMP and FedRAMP is less related to the RAMP and more to the size of the organization. Smaller businesses often qualify for cheaper plans with these subscription tools, while larger organizations need enterprise-level plans with more zeroes attached to the price.

Costs of Consultants and Experts

How many people do you need to bring in to do the work with and for you?

Hiring consultants is another area of extreme variability in costs. You’re almost certainly going to need to hire someone, but whether it’s an individual expert or a whole organization like Ignyte is another story entirely.

Individual well-trained experts and compliance personnel often pull salaries in the low six-figures range, so hiring one or two can be $100,000 to $250,000 for the year. Of course, if you’re only taking them on for a month or two on contract, those prices can be a lot lower.

You can, of course, be looking at much higher costs for full-scale agencies doing a lot more work for you. But you can also find smaller agencies that cater to smaller-scale needs and have lower prices to match. The niche is there, so businesses offer their services to fill it.

Costs of Program Application and Membership

So far, just about all of the costs have been similar between FedRAMP and GovRAMP, and are more determined by the scale of your business. One of the biggest differences between the two RAMPs is their official costs.

FedRAMP, in fact, doesn’t actually have official costs. As a government-managed program, it costs enough to meet their standards and undergo audits, so they don’t charge additional fees for membership dues or application fees.

GovRAMP, meanwhile, has membership options. GovRAMP memberships start at $1,500 per year and increase the larger the organization you represent, and the more membership benefits you want.

This is one area where GovRAMP is technically more expensive than FedRAMP, but we’d say that it all balances out considering the scale and expenses in every other arena. GovRAMP simply doesn’t have official federal government funding in the same way as FedRAMP, so they have to support their organization somehow.

Costs of Official Audits

Both GovRAMP and FedRAMP require an official audit conducted by a certified third-party assessment organization in order to achieve a full authority to operate.

In many cases, the list of assessment organizations is actually quite similar. GovRAMP extended another element of reciprocity here and accepts that FedRAMP-authorized 3PAOs are going to be good enough to get the job done for GovRAMP as well.

The official costs of these audits are also variable depending on the scope and scale of your business. Low-end auditing can be as much as $50,000, while the largest and most elaborate audits can be $300,000 or more.

These costs recur, as well. While you don’t need audits every year, you do need recertification periodically, and contracts often stipulate it as once every three years.

Costs of Ongoing Compliance and Monitoring

Both FedRAMP and GovRAMP are security standards, but they are also living, moving targets. The world of cybersecurity is constantly changing, the threat environment is always evolving, and it’s your job to keep up.

Implementing continuous monitoring is a big part of this, and continuous monitoring is a surprisingly high cost.

It’s not just about the cost of monitoring tools. You also have to consider ongoing training and employee testing, occasional systems testing, and the salaries of people trained to oversee and conduct all of this monitoring.

There are also smaller-scale audits along the way.

Overall, all of these costs can add up. Many organizations, between annual assessments, continuous monitoring, and staffing, find they’re spending an additional $150,000 to $500,000 annually.

Overlapping Costs and Directional Reciprocity

While looking at a list of costs like this, it can feel insurmountably expensive to do both. While you can certainly pursue one, like FedRAMP, and then save to apply for GovRAMP later (or vice versa), it’s also worth mentioning that a lot of these costs overlap.

Since GovRAMP is largely based on the same sorts of NIST security standards and protocols as FedRAMP, implementing that security doesn’t need to be done separately for both. You don’t need to pay to implement MFA or encryption twice, right? Once it’s implemented, it’s implemented, as long as it’s at the right level of standard.

There are only some of these costs that are truly unique to one program or the other. Application fees, membership dues, and similar program fees aren’t overlapping, and you will generally need to undergo a second audit, though doing the prep-work for the audit will be much faster, cheaper, or completed already.

It’s also important to know about the limited reciprocity between these programs. It’s limited because it’s not reciprocal, but FedRAMP is considered the more stringent and higher-bar standard. GovRAMP, therefore, accepts that if you’ve achieved a FedRAMP ATO, you’re already most of the way there for StateRAMP adherence. They even provide a fast-track option for GovRAMP authorization.

This only works in one direction. While going through the work and achieving GovRAMP authorization will put you in a good place to achieve FedRAMP authorization, FedRAMP doesn’t automatically recognize GovRAMP the way GovRAMP recognizes FedRAMP.

This means you can save some on your costs by going for FedRAMP first, if it’s advisable and you have the option to do so. That said, even getting the FedRAMP sponsor to start the process can be a tall order for many CSPs, so GovRAMP may be the better starting point.