A customer's completion of StateRAMP authorization is a distinctive testimonial moment in the state-and-local-government (SLG) vertical because the StateRAMP framework — modeled on FedRAMP but operated by a non-profit consortium and adopted on a state-by-state opt-in basis — produces verifiable artifacts, carries agency-relationship constraints, and aligns with state procurement calendars that vary by state and rarely match the federal fiscal year. Most testimonial programs treat StateRAMP completion as interchangeable with FedRAMP completion, but the operational reality is that StateRAMP authorizations are state-marketplace-listed (not federal-marketplace-listed), the impact-level taxonomy is similar but not identical, and the procurement-calendar alignment must target the specific states whose marketplaces list the authorization.
This guide separates the StateRAMP authorization cycle into four phases, explains the testimonial-wall risks in each phase, and provides per-phase playbooks calibrated to the state-and-local-government procurement mechanics that most SLG customers operate under. For broader context on compliance-anchored testimonials, see the playbooks on testimonials from government and public sector clients, testimonials when a customer completes a FedRAMP authorization, and testimonials when a customer completes ISO 42001 certification.
The four StateRAMP authorization-cycle phases
A typical StateRAMP authorization path runs through readiness verification, third-party security assessment, Project Management Office (PMO) review, and authorization issuance. The cycle commonly spans nine to eighteen months for the StateRAMP Moderate Impact level. SLG customers move through four distinct phases relative to authorization.
Phase 1: Readiness (the verification phase before the formal security package is submitted). The customer is selecting a 3PAO, assembling the System Security Plan, and remediating gaps against the StateRAMP control baseline (which aligns with NIST SP 800-53 but is adapted for state-and-local context). The customer is highly engaged with the vendor's security posture but cannot yet claim authorization. Testimonials produced during readiness have a security-posture-and-control-mapping character — the customer can speak to the vendor's documentation quality, control-mapping clarity, and gap-remediation responsiveness, but cannot claim authorization status.
Phase 2: Assessment and PMO review (the period between security assessment kickoff and PMO authorization decision). The customer has engaged the 3PAO and is producing the full security assessment artifacts. The customer is highly engaged operationally and is preparing the package for StateRAMP PMO review. Testimonials produced during assessment-and-PMO-review have an assessment-process-and-vendor-collaboration character — the customer can speak to vendor responsiveness during 3PAO assessment and evidence-package quality, but should not claim authorization status before PMO authorization issuance.
Phase 3: Post-authorization (the period after authorization is issued and the listing appears on the StateRAMP Authorized Vendor List). The customer holds an active StateRAMP authorization and has accumulated operational data from the secure environment. The customer is the highest-value testimonial source for state-and-local-vertical claims because the authorization is publicly verifiable through the StateRAMP Authorized Vendor List. Testimonials produced post-authorization have an authorization-realized character — the customer can claim authorization status with substantiation, quote the specific impact level (Low, Moderate, or High), and reference the publicly listed authorization date.
Phase 4: Continuous monitoring (the ongoing ConMon cycle that follows authorization issuance). The customer holds an active authorization and is producing the StateRAMP-required continuous-monitoring deliverables on the consortium's cadence. Testimonials produced during continuous monitoring have a sustained-authorization character — the customer can speak to the vendor's continuous-monitoring support, audit-cycle responsiveness, and the operational predictability of the authorized environment across multi-state deployments.
Per-phase playbook for the state-and-local-government testimonial wall
Phase 1: Readiness
During readiness, the testimonial wall faces a premature-authorization-claim risk and a framework-confusion risk.
First, do not request authorization claims from readiness customers. The readiness customer has not yet received PMO authorization and cannot substantiate authorization status. A quote that claims StateRAMP authorization during readiness will not survive verification against the Authorized Vendor List. The remediation is to request security-posture and control-mapping quotes that the customer can substantiate from their current readiness work.
Second, avoid framework confusion in the quote framing. Readiness customers and uninformed reviewers sometimes conflate StateRAMP with FedRAMP, and a quote that references "federal-grade authorization" or "FedRAMP-equivalent" during a StateRAMP readiness phase invites both a substantiation challenge and a regulatory-accuracy challenge. The remediation is to use precise framework names in every quote and to require the customer to confirm framework specificity during the quote-request interview.
Phase 2: Assessment and PMO review
During assessment-and-PMO-review, the testimonial wall faces a premature-completion-claim risk and a PMO-decision-disclosure risk.
First, request assessment-process quotes only. The customer is in the middle of the formal assessment and has not yet received PMO authorization. A quote that claims authorization is premature and will not survive verification. The remediation is to request quotes about assessment responsiveness, evidence-package collaboration, and 3PAO interaction quality — not authorization status.
Second, do not pre-announce PMO decisions. A quote that anticipates a favorable PMO authorization outcome before the PMO decision issues creates both a regulatory-accuracy risk and a relationship risk if the PMO requires additional remediation. The remediation is to defer all authorization-outcome quotes until the PMO decision is on the public record.
Phase 3: Post-authorization
During post-authorization, the testimonial wall faces a substantiation-leverage opportunity and an impact-level-mismatch risk.
First, prioritize the post-authorization phase for authorization-claim collection. The post-authorization customer is the highest-value testimonial source on the SLG-vertical wall because the authorization is publicly listed on the StateRAMP Authorized Vendor List and the impact level (Low, Moderate, High) is verifiable. The remediation is to concentrate authorization-claim collection in the post-authorization phase and to require quotes to reference the specific impact level achieved.
Second, match impact-level claims to the actual authorization. A vendor authorized at StateRAMP Moderate cannot truthfully publish a testimonial that implies StateRAMP High coverage. The remediation is to coach the customer toward impact-level-specific framing during the quote-request interview and to validate the impact-level claim against the public Authorized Vendor List before publication. For broader treatment of claim substantiation, see the playbook on testimonial claim substantiation with data.
Phase 4: Continuous monitoring
During continuous monitoring, the testimonial wall faces a sustained-authorization opportunity and a multi-state-disclosure risk.
First, treat the ConMon phase as a recurring quote-trigger window. Each annual assessment cycle, each significant-change submission, and each state-marketplace expansion produces a fresh substantiation moment for sustained-authorization claims. The remediation is to time a quote-request conversation to the moment immediately after each annual assessment completion (typically within thirty days of the ConMon anniversary) so the customer's framing is fresh and the substantiation is current.
Second, manage multi-state disclosure carefully. A ConMon-phase quote that names multiple states where the vendor is deployed may inadvertently disclose information about specific state agency relationships that some states treat as confidential. The remediation is to default to state-count language ("deployed across multiple state-government environments") and to escalate to named-state language only after explicit written disclosure approval is obtained from each named agency.
The seven quote-request timing risks
Risk 1 — Authorization claim during readiness. The customer has not yet received PMO authorization and cannot substantiate. Remediation: defer authorization claims until phase 3.
Risk 2 — Completion claim during assessment-and-PMO-review. The customer is mid-assessment and PMO authorization has not yet issued. Remediation: require explicit phase markers and substitute assessment-process framing.
Risk 3 — Impact-level mismatch. The quote implies an impact level higher than the actual authorization. Remediation: validate impact-level against the public Authorized Vendor List before publication.
Risk 4 — Framework confusion with FedRAMP. The quote conflates StateRAMP with FedRAMP and creates a substantiation gap because the two frameworks have separate authorization listings. Remediation: require precise framework names and validate against the correct marketplace listing.
Risk 5 — Multi-state-disclosure leak. The quote names specific state agencies that the agencies treat as confidential relationships. Remediation: default to state-count language and escalate to named-state only after written approval.
Risk 6 — Calendar misalignment at publication. A StateRAMP-anchored quote runs on the wall without regard to the fiscal calendars of the specific states the customer represents (which vary — most states are July-to-June, some are October-to-September, and a few align with the calendar year). Remediation: rotate StateRAMP quotes onto the wall in alignment with the dominant state-fiscal-year start dates for the customer base being targeted.
Risk 7 — Authorization-status drift. The customer's StateRAMP authorization lapses, the impact level changes, or a significant change requires re-authorization, and the quote's claim becomes stale. Remediation: re-validate authorization status against the StateRAMP Authorized Vendor List at each annual refresh and pull quotes whose claims no longer match the current state.
What to publish and what to omit
Testimonials calibrated to StateRAMP authorization should publish: the customer's phase position at the time of the quote (with explicit phase markers where the claim is mid-cycle), the impact level (Low, Moderate, or High) for post-authorization quotes, the state-count or named-state context where explicit disclosure approval has been obtained, and the rotation slot that aligns with the dominant state-fiscal-year start dates for the targeted customer base.
Testimonials should omit: authorization claims from customers in readiness or assessment-and-PMO-review phases, impact-level claims that exceed the actual authorization, framework conflations between StateRAMP and FedRAMP, and named-state references without written disclosure approval.
The ProofShow approach to StateRAMP-anchored testimonials emphasizes phase-claim alignment, impact-level specificity, framework-name precision, multi-state-disclosure discipline, and calendar-aligned rotation that targets state procurement windows. For broader context on temporal and substantiation strategy, see the playbooks on testimonials in different budget-cycle phases, testimonial confidentiality and NDA handling, and testimonial recency vs. volume tradeoff.