Skip to content
Documentation

Splunk

What this guide covers

How to actually buy Splunk for a Maryland agency — which statewide vehicle you ride, which reseller fulfills the order, the FedRAMP/ATO path, and the functionality gates to clear before you sign. Splunk’s government FedRAMP story is split across two separate listings (Moderate and High), so the most important decision here is which one your data classification requires.

Who it’s for

Engineering leads, security staff, and procurement officers at a Maryland State agency or education entity who have decided they need Splunk for SIEM, log analytics, or security orchestration (or are comparing it against the self-hosted stack) and need the path from “we want it” to “it’s authorized and on contract.”

Part of the SaaS Catalog. For the vehicles themselves, see Maryland Master Contracts; for the process and thresholds, see Maryland Procurement.

Disclaimer. Not legal or procurement advice. FedRAMP authorizations, contract catalogs, and BPO numbers change as awards are renewed and authorizations are re-baselined. Verify every figure below against the FedRAMP Marketplace, the Carahsoft Maryland COTS page, and the DoIT Statewide Contracts hub before relying on it. Splunk maintains two distinct FedRAMP boundaries — confirm which listing you are inheriting.

TL;DR

  • Category: Security — SIEM and log analytics (also observability).
  • Maryland vehicle: COTS 2012, BPO 060B2490021, via Carahsoft (Splunk is on the Carahsoft MD COTS publisher list); also reachable via NASPO ValuePoint.
  • Reseller: Carahsoft is the primary public-sector aggregator.
  • Authorization: Two separate FedRAMP listings — Splunk Cloud Platform for FedRAMP High (High, certified 2024-09-13) and Splunk Cloud Platform for FedRAMP Moderate (Moderate). Splunk SOAR is FedRAMP Moderate. Splunk Cloud Platform is also StateRAMP/GovRAMP Moderate authorized.
  • The ATO trap: Only the Splunk Cloud Platform government boundary is authorized — commercial / self-managed Splunk is not, and Moderate and High are separate listings/boundaries.

What This Tool Is

Splunk is a SaaS platform for searching, monitoring, and analyzing machine-generated data — its public-sector center of gravity is SIEM and log analytics (security event correlation, threat detection, compliance reporting), with an observability practice alongside it. Agencies reach for Splunk when they want a managed, indexed search layer over high-volume log and security telemetry instead of operating that pipeline themselves. The self-hostable log/observability alternative is Loki + Grafana — see Tools and Software → Observability — but for SIEM at scale most agencies treat Splunk Cloud as a procurement-and-ATO exercise, which is what this page covers.

Which Maryland Vehicle

VehicleBPOHow Splunk rides it
COTS 2012060B2490021The primary path. Splunk appears on Carahsoft’s Maryland COTS publisher catalog; you issue an order against the COTS master contract and Carahsoft fulfills it.
NASPO ValuePointMaryland participating addendum (Carahsoft)A cloud/SaaS alternative the State extended into Maryland. Compare ceiling pricing against COTS before choosing.

The same publisher can be reachable through more than one Carahsoft vehicle, and which one you ride affects ceiling pricing, terms, and which approvals apply — see Maryland Master Contracts → Where Carahsoft Fits and the Splunk entry on Carahsoft’s MD COTS publisher list.

Resellers and Pricing Path

Carahsoft is Splunk’s primary public-sector aggregator and the reseller holding the Maryland awards. You do not buy a “Carahsoft contract” — Carahsoft fulfills your order against the COTS master contract (or the NASPO addendum). Request a quote referencing the Maryland COTS BPO 060B2490021 so the order is priced against the statewide ceiling rather than commercial list price. Splunk is priced on data volume (ingest/workload-based), so the quote depends on your daily indexing volume — size it before you ask, and revisit it, because ingest-based bills drift upward.

Authorization and ATO

AttributeValue
Authorized offeringSplunk Cloud Platform (government boundary) — two separate FedRAMP listings
FedRAMP — HighSplunk Cloud Platform for FedRAMP High = High, certified 2024-09-13, Marketplace ID FR2314156865
FedRAMP — ModerateSplunk Cloud Platform for FedRAMP Moderate = Moderate, Marketplace ID F1607197917
Splunk SOARFedRAMP Moderate
GovRAMP (StateRAMP)Moderate authorized (Splunk Cloud Platform)
Commercial / self-managed Splunk in scope?No — only the Splunk Cloud Platform government boundary is authorized

The single thing to get right for the ATO: purchase and provision the Splunk Cloud Platform government boundary at the impact level your data classification requires, and confirm which listing you are inheriting. Moderate (F1607197917) and High (FR2314156865) are separate listings with separate control sets — a Moderate authorization does not cover a High workload, and commercial or self-managed Splunk gives you no FedRAMP authorization to inherit at all. Confirm the match before you commit; the gap will surface late in your security review.

Functionality Gates to Verify

Clear these before price comparison — any one can disqualify the buy regardless of cost. See the canonical list in Tools and Software → Enterprise Functionality.

GateSplunk-specific note
SSO (SAML/OIDC) + SCIMSupported; confirm SCIM de-provisioning is included at your tier, not gated to a higher plan.
Audit logsAvailable; confirm retention meets your records policy.
RBACGranular roles supported; map them to least-privilege before rollout.
Data residency / FedRAMP boundaryThe Splunk Cloud Platform government boundary is the residency answer — confirm the correct Moderate vs. High listing (see above).
Accessibility (VPAT/ACR)Request Splunk’s current VPAT; Maryland’s Nonvisual Access (NVA) requirement applies to the procurement.
BAA / DPARequired if any ingested data could carry PII/PHI; confirm availability for the government boundary.

Procurement Steps

  1. Confirm the need over the OSS alternative. For log/observability, Splunk replaces the self-hostable Loki + Grafana stack ($0 license). Document why managed SIEM/log analytics is worth the spend — that rationale is the core of the budget justification.
  2. Register / confirm eMMA. Your agency and the reseller must be set up in eMMA.
  3. Pick the vehicle. Default to COTS 060B2490021; compare the NASPO ValuePoint addendum if cloud terms suit you better.
  4. Determine your impact level. Decide whether your data classification requires the Moderate or High Splunk Cloud Platform listing — this drives the boundary you inherit.
  5. Get a Carahsoft quote referencing the BPO, sized to your daily ingest volume, for the correct government listing.
  6. Check the threshold. The order’s dollar value drives the method — purchasing card, small procurement, or BPW review. See Maryland Procurement → how the value picks the path. Do not split a buy to dodge a threshold.
  7. Run the ATO package. Inherit the FedRAMP controls for the correct Splunk Cloud Platform listing (Moderate or High); document the rest.
  8. Issue the order against the vehicle once approvals clear.

Sources

ClaimSource
Splunk Cloud Platform for FedRAMP High (FR2314156865)FedRAMP Marketplace — FR2314156865
Splunk Cloud Platform for FedRAMP Moderate (F1607197917)FedRAMP Marketplace — F1607197917
Splunk Cloud FedRAMP High authorizationSplunk — Splunk Cloud Attains FedRAMP High Authorization
Splunk Cloud Platform StateRAMP/GovRAMP ModerateSplunk — StateRAMP Moderate authorization
Splunk on the Maryland COTS catalogCarahsoft — Maryland State Contracts

Splunk maintains two distinct FedRAMP boundaries (Moderate and High). Re-verify which listing matches your data classification against the Marketplace listings before relying on any figure here.