Building a Compliance Framework for Providers and Agencies

Building a cybersecurity-compliance framework is about more than simply purchasing services from a GovRAMP-certified provider. For instance, GovRAMP itself states that “using an infrastructure with a GovRAMP Authorized status does not automatically make the service provider’s system GovRAMP compliant. Each layer (e.g. IaaS, PaaS, and SaaS) must be evaluated on its own for the provider to obtain a GovRAMP Authorized status.”