On 1 October 2026 Georgia began requiring new state contracts that include cloud services to follow its GovRAMP-aligned cloud standard, and from 1 July 2027 full compliance with GovRAMP verification becomes mandatory for every Georgia procurement with a cloud component. The penetration test has the tightest clock: GovRAMP's Penetration Testing Requirements Guide, version 1.1 (February 2026), says the initial test "must be performed no more than 6 months prior to the submission of the SAR."
StateRAMP announced on 14 February 2025 that it would operate as GovRAMP and "will legally remain the organization's name"; the testing guide still says StateRAMP 37 times.
Quick answer. Yes, for Authorized and Provisionally Authorized status. Section 8 of GovRAMP's guide says "a penetration test must be completed by a 3PAO" for each initial authorization, no more than six months before the Security Assessment Report (SAR) is submitted, then "at least every 12 months" in continuous monitoring. Each test covers six mandatory attack paths, and any deviation needs an Authorizing Official's approval. Ready is not clear-cut: the Security Assessment Framework calls the test required, but the controls matrices mark CA-8 "Required for Ready: No," so confirm it in writing. Stingrai, a CREST-accredited penetration testing firm, runs the testing a provider commissions itself (readiness testing, phishing campaigns a 3PAO can independently evaluate, and significant-change tests) as a one-time annual engagement or a continuous program.
Who needs GovRAMP
GovRAMP verifies cloud products, IaaS, PaaS and SaaS, that process, transmit or store a public organization's data. It is a nonprofit program, not a law: a vendor needs a status when a government's policy or contract asks for one, as Georgia's policy now does. North Carolina's GovRAMP-aligned requirements took effect on 1 April 2026; Nevada's were scheduled for 1 July 2026. GovRAMP's participating governments page listed 73 organizations in 33 states on 16 October 2026 (its counter shows 72), where participation "can reflect exploration, planning, or active implementation," and an April 2026 roundup named Arizona, Indiana, Massachusetts, Minnesota, Nevada, New Hampshire, North Carolina, North Dakota, Oregon, Texas and Utah among the states using GovRAMP.
What GovRAMP's penetration testing guide requires
The 22-page guide is written for providers "planning to use a third-party assessment organization (3PAO)," and its obligations sit in five places:
Scope (section 2): "all components, associated services, and access paths (internal/external) within the defined test boundary of the SP's system must be scoped and assessed," and every attack path is tested or its exclusion explained.
Deviations (sections 2 and 4): deviations from the mandatory or scoped-in attack paths "must be approved by an Authorizing Official (AO)," are recorded in the SAR and "may be seen as a high-risk finding" by the 3PAO.
Method (section 3): the test "should not solely rely on automated scanning techniques" and should be able to attain the 14 MITRE ATT&CK Enterprise and 14 Mobile tactics the guide lists.
Rules of engagement (section 6): written by the 3PAO under NIST SP 800-115 and copied into the Security Assessment Plan (SAP), with a duty to report "any critical high-impact vulnerabilities as soon as they are discovered" to the CIO, CISO, ISSO and the SLED AO or Approvals Committee.
Schedule (section 8):
For each initial security authorization, a penetration test must be completed by a 3PAO as a part of the assessment process described in the SAP. This initial penetration test must be performed no more than 6 months prior to the submission of the SAR. Once within the continuous monitoring phase of the StateRAMP process, additional penetration testing activities must be performed at least every 12 months, unless otherwise approved by an authorizing body with documented rationale.
The guide shows its age: version 1.1's only logged change is a "Branding update," its templates link returns a 404, and the Low "Minimum Mandates" and "Security Controls Baseline Summary" it names are not in the library, where the Rev. 5 controls matrices now mark what each status requires.
Figure 1: What GovRAMP's documents require of a penetration test, read 16 October 2026. Source: GovRAMP document library.
Which GovRAMP statuses need a penetration test
Status | Who assesses | Penetration test | Continuous monitoring |
|---|---|---|---|
Security Snapshot and Progressing Snapshot | GovRAMP PMO, 40 controls | Not in the criteria; scoring may award points for one | Quarterly in the Progressing program |
Core | GovRAMP PMO, 60 controls, no 3PAO | Optional: the provider "may optionally submit a Pen Test" | Quarterly |
Ready | 3PAO readiness assessment (RAR), 80 controls at Moderate | The framework says required; the controls matrices mark CA-8 not required for Ready | Monthly, plus an annual 3PAO assessment |
Provisionally Authorized and Authorized | 3PAO security assessment (SAR), 300+ controls, plus a government sponsor or Approvals Committee approval | CA-8 at least annually; CA-8 (1) independent tester at Moderate and High; initial test within six months of the SAR | Monthly, plus annual announced 3PAO penetration testing |
The Ready row is where GovRAMP's documents disagree. The Security Assessment Framework, version 4.2, says penetration tests "are required ... for initial review for GovRAMP Ready or GovRAMP Authorized statuses." But the Moderate controls matrix marks 80 of its 319 controls required for Ready, none from the CA family, and lists CA-8 as "Required for Ready: No," as the Low and High matrices do; the 3PAO package has a "Penetration Test Report" folder for the SAR and none for the readiness assessment; and the Continuous Monitoring Guide, version 2.0, assigns "announced penetration testing annually" to "[Provisionally Authorized and Authorized only]." Two passages cut the other way: an IR-3 note in the Ready minimum mandates says annual functional testing "may be concurrent with required penetration tests (see CA-8)," and section 3.1 of the monitoring guide has the 3PAO submit "all penetration testing reports" for Ready products too. Get your 3PAO's and the PMO's answer in writing first.
On 16 October 2026 the program participants list showed 163 verified listings: 143 with an Authorized status, 15 Ready, 4 Core and 1 Provisionally Authorized.
The six mandatory attack paths
Section 4.1 makes six paths "mandatory ... for all authorized systems." They mirror the six attack vectors in FedRAMP's Penetration Test Guidance version 3, with "SP" where FedRAMP says "CSP":
External to Corporate is phishing aimed at administrators and staff with management or support access, measuring "user compliance, not email security"; results are "roles and metrics only, not specific names," and any sampling needs the PMO's approval.
External to SP Target System treats every endpoint as known, bypasses web application firewalls, and has 3PAOs "elevate risk ratings higher for compromise scenarios originating from public access."
Tenant to SP Management System is "a comprehensive application test that attempts to access the SP management systems" with "the highest level of permissions available to customer users," in production: "an SP's production environment must be resilient enough to sustain a 3PAO penetration test."
Tenant to Tenant tries to use one tenant's access to compromise another, with "two full production customer tenants" or a temporary tenant if no second one exists.
Mobile Application to Target System runs on "a representative mobile device" and is out of scope only when the product has no mobile app.
Client-side Application and/or Agents brings components installed in customers' environments inside the authorization boundary; essential ones are tested.
Figure 2: GovRAMP's six mandatory attack paths, section 4.1 of the guide. Source: GovRAMP, Penetration Testing Requirements Guide v1.1.
Section 5 spares paths "already addressed by other StateRAMP Authorized services lower in the 'cloud stack'," such as an authorized IaaS, if the boundary and inherited controls are justified.
Who may perform the test
The test that goes into the package comes from a 3PAO: section 8 says so for the initial test, the Continuous Monitoring Guide for annual testing, and CA-2 (1) in the Moderate matrix reads "For all authorizations, service provider must use a GovRAMP accredited 3PAO." GovRAMP adopted FedRAMP's A2LA-based accreditation standards and "grandfathered all FedRAMP-approved 3PAOs," per its 3PAO Accreditation Process Guide; on 16 October 2026 the participants page listed 32 participating 3PAOs.
Your own tester has three openings:
Readiness testing before the assessment, to find what would otherwise land in the SAR and the POA&M (our recommendation, not a GovRAMP rule).
The phishing path: "3PAOs must either perform the attack themselves or independently evaluate the effectiveness of a third-party phishing campaign."
Significant changes: for Provisionally Authorized and Authorized products, "Additional penetration testing is required when the SP has made a significant change," and "Unless required by the SLED Authorizing Body and/or Federal AO, this testing does not have to be conducted by a 3PAO but shall be included in the required annual testing by the 3PAO." The Significant Change Request Form asks whether a change "Is adding AI to the product for the first time" or "Is changing the AI model used in the system."
GovRAMP's FAQ says bug bounties "are not formally accepted as standalone evidence at this time," and while GovRAMP "does not require U.S. citizenship for employees," "some governments may impose additional requirements."
GovRAMP compared with FedRAMP and TX-RAMP
Point | GovRAMP | FedRAMP | TX-RAMP |
|---|---|---|---|
Penetration test named | Yes: guide v1.1; CA-8 for Authorized | Yes: Penetration Test Guidance v3; CA-08 | No: Program Manual 3.0 never uses the word "penetration" |
Non-conformance justifications and phishing sampling go to | The GovRAMP PMO | An Authorizing Official | Not applicable |
Red team exercises, CA-8 (2) | "Control Not Selected by GovRAMP" at Moderate and High | Shown in GovRAMP's Federal Overlay as a FedRAMP requirement | Not applicable |
Reuse across programs | Fast Track: "no new audit" for FedRAMP Ready, ATO or P-ATO | Class A accepts "GovRAMP at any Impact Level" completed within 12 months | StateRAMP Ready gives Level 1; Authorized gives the matching level |
The red team row comes from GovRAMP's Federal Overlay and the Class A entry from FedRAMP's certification rules; our FedRAMP penetration testing guide covers the federal side.
Under TX-RAMP's Program Manual 3.0, services certified through StateRAMP "will not be required to provide continuous monitoring artifacts to DIR," while directly certified ones owe quarterly or annual vulnerability reports (see our Texas guide).
Scoping the test
Scope starts from the System Security Plan and the Authorization Boundary Diagram, and "Penetration testing should not be performed on assets for which permission has not been explicitly documented." Two decisions carry the most risk:
Production: paths 3 and 4 run in production with privileged customer accounts and two tenants, so agree windows and stop conditions; the SAP template excludes denial of service attacks by default.
Third parties: approvals from ISPs, MSSPs and hosts are the provider's job, and a data subprocessor without GovRAMP Authorized status or a FedRAMP authorization caps the product at Provisionally Authorized.
Our guides to cloud penetration testing rules of engagement and multi-tenant SaaS penetration test scope go deeper on paths 3 and 4.
What the tester must deliver
A test plan and ROE that address all six paths or justify each exclusion; the ROE "must be signed by both the 3PAO and SP" (SAP template).
A report inside the SAR covering scope, attack paths, timeline, tests and results, findings and evidence, and access paths. "There is no template provided," sensitive data in screenshots is made "permanently unrecoverable," and passwords never appear.
Remediation evidence: penetration test findings go on the POA&M and are fixed within 30, 90 and 180 days for high, moderate and low risk (15, 30, 60 and 90 days for critical, high, medium and low under the CJIS-aligned overlay), and GovRAMP's RA-5 (d) requirement makes a CISA KEV due date supersede its own timeline.
Evidence handling: the Authorization Boundary Guide lists "Active threat assessment, penetration test or security investigation information and communications" among SLED metadata that "must reside within the authorization boundary or within the boundary of another GovRAMP-authorized information system," so agree where findings will be stored before testing.
The annual package on time: delivery more than 30 days after the anniversary letter date triggers a corrective action plan.
A first-year plan
When | Activity | Basis |
|---|---|---|
Month 0 | Classify data, choose the impact level, draw the boundary, engage a 3PAO | Framework 1.5.4; guide section 5 |
Months 1 to 3 | Readiness testing scoped to the six paths by your own tester; fix and retest; start monthly authenticated scans | Our recommendation; scan guide |
Month 4 | SAP and ROE signed; phishing templates approved; tenants and privileged accounts provisioned | Guide sections 4.1 and 6 |
Month 5 | 3PAO penetration test, no more than six months before the SAR | Guide section 8 |
Month 6 | SAR, POA&M and package to the PMO; sponsor or Approvals Committee review | Framework 1.5.9 |
Every month | Continuous monitoring, POA&M and scans; 30 days' notice before a significant change and a test after it | Continuous Monitoring Guide |
Month 12 onward | Annual 3PAO assessment of about a third of the controls and the annual penetration test | Continuous Monitoring Guide |
GovRAMP's Authorized page puts verification at "six to twelve months after engaging a 3PAO" on average, so a vendor engaging one in October 2026 lands between April and October 2027 (our arithmetic), around Georgia's 1 July 2027 date; Georgia says interim verification pathways "will be available to qualifying providers actively progressing through the GovRAMP process."
What GovRAMP costs
GovRAMP publishes PMO fees, not assessment prices; its fee schedule, effective 1 January 2027, sets the annual PMO review for Ready at US$537, US$2,683 or US$4,025, and for Authorized or Provisionally Authorized at US$1,610, US$5,367 or US$8,050, for providers with annual revenue under US$1 million, US$1 million to US$5 million, and over US$5 million. Continuous monitoring costs US$268, US$537 or US$1,073 a month; GovRAMP's Ready page adds that "Associated 3PAO costs are not included." Participating 3PAOs offer discounts of up to 30% to providers that completed the Progressing Snapshot or achieved Core.
Stingrai's fixed prices cover one web application and associated APIs: the Autonomous Pentest by Snipe, with no penetration testers, at US$3,000 per assessment or US$650 a month on a 12-month plan, and the Hybrid Pentest at US$6,800 per assessment or US$1,275 a month (pricing). A readiness test scoped to the GovRAMP attack paths, with cloud, network, mobile and phishing work, is human-led and quoted through Get a Quote.
What to ask a penetration testing vendor
Will the plan cover all six attack paths, record any untested path as a deviation, and report to sections 7.1 to 7.6?
Can you test production with privileged customer accounts and two tenants, and what stops a test?
Will your phishing campaign meet section 4.1.1 so our 3PAO can evaluate it?
Where will findings and reports be stored, and can they come into our own systems?
Is retesting included, and how fast can you test after a significant change?
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a GovRAMP provider, Stingrai is the tester you commission yourself, beside your 3PAO, before and between its assessments. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, and Stingrai Inc. holds CREST accreditation for penetration testing (CREST Marketplace).
Paths 1 and 2: phishing campaigns built to section 4.1.1's rules, plus external network and internet-facing application testing.
Paths 3 and 4: authenticated web application and API testing across every user role, aimed at broken authorization, IDOR and business logic across tenants, and cloud testing from the control plane to the workload in AWS, Azure and Google Cloud.
Path 5: iOS and Android testing of the app binaries and their backend, aligned with OWASP MASVS.
Evidence: every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a proof of concept and remediation guidance; retesting is included, and every human-led and hybrid report ships with an attestation letter.
Engagements run as a one-time annual test timed to your SAR window or as a continuous program. Snipe, Stingrai's autonomous AI agent, covers web applications and their APIs only; mobile, cloud, network and phishing work is human-led. Stingrai is based in Toronto with a London office and serves US clients remotely.
Frequently Asked Questions
Does GovRAMP require a penetration test?
Yes, for Authorized and Provisionally Authorized status. Section 8 of the guide says a penetration test "must be completed by a 3PAO" for each initial authorization, no more than six months before the SAR is submitted, and at least every 12 months in continuous monitoring. Core makes the test optional; GovRAMP's documents disagree on Ready.
How often does GovRAMP require penetration testing?
The initial test must fall no more than six months before the SAR is submitted, with further testing at least every 12 months unless an authorizing body approves otherwise. Provisionally Authorized and Authorized products also need a test after every significant change.
Who can perform a GovRAMP penetration test?
The test in the SAR must come from a 3PAO accredited through A2LA under the FedRAMP standards GovRAMP adopted. A provider's own tester can run significant-change tests unless the authorizing body requires a 3PAO, and can run the phishing campaign if the 3PAO independently evaluates it.
Does GovRAMP Ready require a penetration test?
GovRAMP's documents disagree. The Security Assessment Framework says penetration tests are required for initial review for Ready, but the controls matrices mark CA-8 "Required for Ready: No" and the annual 3PAO penetration test applies to Provisionally Authorized and Authorized only. Confirm it with your 3PAO and the GovRAMP PMO in writing.
What are the GovRAMP mandatory attack paths?
Section 4.1 lists six: External to Corporate, External to SP Target System, Tenant to SP Management System, Tenant to Tenant, Mobile Application to Target System, and Client-side Application and/or Agents to Target System. Deviations need an Authorizing Official's approval.
Is GovRAMP the same as StateRAMP?
Yes. StateRAMP announced on 14 February 2025 that it would operate as GovRAMP and remains the legal name; the penetration testing guide still says StateRAMP throughout its body.
Related reading
References
GovRAMP. Penetration Testing Requirements Guide, version 1.1, February 2026. https://govramp.org/hubfs/Resources%20-%20Updated%20Branding/Penetration%20Testing%20Requirements%20Guide.pdf
GovRAMP. Security Assessment Framework, version 4.2, adopted 21 April 2026. https://govramp.org/hubfs/GovRAMP%20Security%20Assessment%20Framework.pdf
GovRAMP. Continuous Monitoring Guide and Escalation Process, version 2.0, and Vulnerability Scan Requirements Guide, version 1.2. https://govramp.org/hubfs/Continuous%20Monitoring%20Guide%20and%20Escalation%20Process.pdf and https://govramp.org/hubfs/Resources%20-%20Updated%20Branding/Vulnerability%20Scan%20Requirements%20Guide.pdf
GovRAMP. Rev. 5 controls matrices (Moderate V1.06; Low and High in the Service Provider Packages) and Ready Minimum Mandatory Requirements, version 3.0. https://govramp.org/hubfs/GovRAMP-Controls-Matrix_Mod_Rev5_V1.06.xlsx and https://govramp.org/document-library
GovRAMP. Federal Requirements Overlay, version 1.0, and CJIS-Aligned Overlay. https://govramp.org/hubfs/GovRAMP%20Federal%20Overlay.xlsx and https://govramp.org/hubfs/GovRAMP%20CJIS-Aligned%20Overlay%20Control%20and%20Parameters.xlsx
GovRAMP. Authorization Boundary Guide, version 1.2, February 2026. https://govramp.org/hubfs/Authorization%20Boundary%20Guidance.pdf
GovRAMP. Moderate Impact 3PAO Package and 3PAO Accreditation Process Guide, version 1.2. https://govramp.org/hubfs/Resources%20-%20Updated%20Branding/GovRAMP_Moderate-Impact-3PAO-Package.zip and https://govramp.org/hubfs/3PAO%20Accreditation%20Process%20Guide.pdf
GovRAMP. Significant Change Request Form. https://govramp.org/hubfs/GovRAMP%20Significant%20Change%20Request%20Form.xlsx
GovRAMP. PMO Fee Schedule, effective 1 January 2027, and Sponsor Requirements for GovRAMP Authorization, February 2026. https://govramp.org/hubfs/Resources%20-%20Updated%20Branding/GovRAMP%20PMO%20Fee%20Schedule.pdf and https://govramp.org/hubfs/Resources%20-%20Updated%20Branding/GovRAMP%20Service%20Provider%20Sponsor%20Requirements.pdf
GovRAMP. Core, Ready and Authorized pages and program participants list, read 16 October 2026. https://govramp.org/core, https://govramp.org/ready, https://govramp.org/authorized and https://govramp.org/program-participants
GovRAMP. Georgia Adopts GovRAMP, 9 September 2026, and StateRAMP Announces Rebrand to GovRAMP, 14 February 2025. https://govramp.org/news/georgia-adopts-govramp and https://govramp.org/news/blog/stateramp-announces-rebrand-to-govramp-reflecting-mission-to-unite-public-and-private-sectors-in-advancing-cybersecurity
FedRAMP. Penetration Test Guidance, version 3, and FedRAMP Certification rules FRC-CLA-ASF and FRC-CLA-EAM. https://www.fedramp.gov/resources/documents/CSP_Penetration_Test_Guidance.pdf and https://www.fedramp.gov/2026/providers/20x/rules/fedramp-certification/
Texas Department of Information Resources. TX-RAMP Program Manual, version 3.0. https://dir.texas.gov/sites/default/files/2023-10/TX-RAMP%20Program%20Manual%203.0%20-%20Effective%2012.31.23.pdf
GovRAMP. Participating governments page and States Across the U.S Highlight GovRAMP, 22 April 2026. https://govramp.org/participating-government-organizations and https://govramp.org/news/states-across-the-u.s-highlight-govramp-to-strengthen-cybersecurity-and-vendor-risk-management
Stingrai. Pricing. https://www.stingrai.io/pricing
Talk to Stingrai
Stingrai will run a readiness test of your product, scoped to GovRAMP's attack paths, before your 3PAO arrives: named penetration testers, retesting and an attestation letter, as a one-time annual engagement or a continuous program. Get a quote or book a free discovery call.
