In the process of shopping around for a physical security solution, almost every state procurement team runs the same comparison: multiple bids from multiple vendors, one with the lowest price. What that comparison usually misses is the work to maintain compliance sitting underneath the price tag, which often doesn't show up until after implementation.
The question that actually matters
More and more states are requiring that cloud-connected systems — including the cloud management plane behind physical security hardware like cameras and access control — meet security baselines built on the NIST SP 800-53 control framework. California's SAM 5315.1 and SIMM 5315-B are one well-documented example, but the underlying pattern (state agencies holding cloud vendors to a federally-derived security bar) isn't unique to one state.
So the question worth asking isn't simply, "What does this cost?" Rather, it is: "Has someone already done the compliance verification, or is my team going to be on the hook for doing it?"
Why GovRAMP exists
This is exactly the gap GovRAMP (formerly StateRAMP) was built to close. It's a nonprofit standards body that enables state and local governments (and sometimes school districts, higher ed, and hospitals) to rely on a single authorization instead of each running its own from-scratch security review. GovRAMP authorizations map directly to NIST SP 800-53, and the program now counts government members across roughly two dozen states, with a handful (Texas and North Carolina among them) writing GovRAMP or equivalent authorization directly into procurement policy.
FedRAMP works the same way at the federal level. Together, the two programs mean a vendor only has to prove its security controls once, and any agency that recognizes the authorization can lean on that proof instead of re-verifying it themselves.
What happens without that authorization
If you select a vendor that is not FedRAMP or GovRAMP Authorized, the compliance obligation doesn't go away. Your team becomes responsible for manually documenting and auditing every required control. California's process for this, the California Cloud Services Assessment under SIMM 141, is a good illustration of what that lift actually looks like in practice: hundreds of individual configurations, each one requiring its own proof, compiled and maintained by internal IT and security staff (often with dedicated vendor support required as well).
What a GovRAMP Authorized vendor is actually doing for you
Verkada Command in AWS GovCloud holds both FedRAMP Moderate Authorization and GovRAMP Moderate Authorization, built around three architectural pillars:
- Data residency and personnel: All data stays within U.S. borders, managed exclusively by U.S. persons.
Data residency and personnel: All data stays within U.S. borders, managed exclusively by U.S. persons.
- Cryptography: Data is protected by FIPS 140-validated cryptography in transit and at rest, from the physical data centers up through the encryption layer.
Cryptography: Data is protected by FIPS 140-validated cryptography in transit and at rest, from the physical data centers up through the encryption layer.
- Isolation: The GovCloud environment runs on dedicated infrastructure, fully separated from the commercial product.
Isolation: The GovCloud environment runs on dedicated infrastructure, fully separated from the commercial product.
Each of those maps back to the control families state frameworks are checking for, which is the point of the authorization in the first place.
The takeaway
Before comparing quotes, it's worth checking which pathway each vendor puts your team on: one where a third party has already done the security verification, or one where your internal staff becomes responsible for it on an ongoing basis.
Disclaimer: This post is for informational purposes only and does not constitute legal advice. Organizations should consult with legal counsel on whether their specific use of Verkada products complies with applicable laws and regulations.
