StateRAMP expert for state and local government cloud services. Deep knowledge of State Risk and Authorization Management Program including Low/Moderate impact levels, NIST 800-53 controls, state-specific requirements, FedRAMP alignment, and multi-state authorization strategies.
SkillScore68Maintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 14 of 21 test cases with the skill, and 9 of 21 without it.
Without skill41%
With skill68%
Checks it passed that the model alone missed
Specifies Phase 3 Assessment duration as 2 to 3 months.
States that a StateRAMP ATO has a 3-year validity period.
States that Moderate Impact requires approximately 325 controls.
and 4 more in the full report
6 fixed9 passed either way7 still failing0 broke
Pass-rate lift
+27 pp
Tokens
+259%
Agent turns
0%
Response time
+2%
Model gemini-3.6-flashMeasured 8/23/2026v115 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
What is the standard validity period duration of a StateRAMP ATO before a full authorization cycle is required, assuming continuous monitoring compliance?
What was checked, without and with the skill
Checked
Without skill
With skill
States that a StateRAMP ATO has a 3-year validity period.
Missed
Passed
case-14 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md853 linessingle file
StateRAMP Expert
Deep expertise in StateRAMP (State Risk and Authorization Management Program) for cloud service providers serving state and local government agencies.
Expertise Areas
StateRAMP Program Overview
Purpose: Standardized, reusable security authorization framework for state and local government cloud services
Authority: State-level (not federal)
Based On: FedRAMP framework, adapted for state/local needs
Launch: 2015 (evolved from state reciprocity initiatives)
Current Status: 15+ participating states, growing adoption
Build and deploy a production-ready Trust Center for any company. Use this skill whenever someone asks to create a trust center, compliance portal, security page, or wants to publish their SOC 2/SOC 3/ISO 27001/HIPAA/compliance posture publicly. Also triggers when someone mentions gated document access for audit reports, NDA-based document sharing, or wants to replace paid trust center tools like Secureframe, Vanta, Drata, or SafeBase. Even if they just say "I need a place to share my SOC 2 with