Topic · govramp

GovRAMP (formerly StateRAMP)

GovRAMP — multi-state cloud authorization program analogous to FedRAMP.

RSS feed ↗

trade-press
Cloudflare lands FedRAMP High, eyes DOD IL4
FedRAMP High and GovRAMP Moderate are real; the IL4 pursuit is still just a declared intention.
Cloudflare achieved FedRAMP High authorization Thursday, allowing civilian agencies to use its platform for High-impact data covering national security, critical infrastructure, financial systems, and other sensitive workloads. GovRAMP Moderate followed in April for state and local governments. The company also announced it plans to seek DOD Impact Level 4 authorization for CUI workloads, but that's a declared intention, not a review in progress. DISA issues IL4 provisional authorizations under the DoD Cloud Computing SRG, and Cloudflare hasn't begun that assessment process. DOE, HHS, Commerce, DHS, Interior, Justice, and State already use Cloudflare technologies.
AUG 10
regulator
GovRAMP Floats Shared Risk Management at Carahsoft Summit
The panel framed cloud security as ongoing agency-vendor collaboration, but the pitch arrived without a rulemaking or any compliance mechanism.
GovRAMP used its panel at GovForward's 8th Annual Carahsoft Summit on FedRAMP to articulate a shared risk management philosophy: government agencies and technology providers jointly identifying and reducing cybersecurity risk through collaboration, transparency, and standardized security practices. The framing pushes past the traditional authorize-and-handoff model. But the session was a discussion, not a policy announcement. No rulemaking or program change accompanied it.
JUL 29
regulator
Three More 3PAOs Join GovRAMP Discount Program
The second expansion since the April launch means providers who've completed Progressing or Core verification now have more assessors competing for their business at up to 30% off.
GovRAMP added SecureIT, AARC-360, and RSM US LLP to its voluntary 3PAO discount program on July 22, the second expansion since the April 2026 launch. Participating assessors offer up to 30% off independent security assessments for service providers that have completed the Progressing Security Snapshot program or achieved Core verification. The cumulative pool of discount-offering 3PAOs continues to grow, which matters most for small and mid-market cloud providers for whom assessment cost has been a real barrier to verification.
JUL 26
regulator
Fishers First City to Adopt GovRAMP Procurement Preference
The Indianapolis suburb is the first municipality to adopt the nonprofit's "verify once, serve many" model, testing whether state-level momentum translates to city procurement.
The City of Fishers will give preferential awards to cloud service vendors that comply with GovRAMP certification for all contracts entered or renewed on or after January 1, 2024. Vendors selling cloud services to Fishers must enroll in GovRAMP's Progressing Snapshot Program at minimum to remain competitive. The adoption marks the first municipal procurement preference for GovRAMP, signaling whether the nonprofit's "verify once, serve many" credential reciprocity model, already in use at the state level, can reshape vendor behavior at the city scale.
JUL 26
regulator
GovRAMP Cuts Assessment Costs, Adds Federal Overlays and AI Self-Reporting
Three parallel compliance pressures (cost, framework fragmentation, and AI opacity) converge in a single release cycle, signaling that state-level authorization is reaching operational maturity.
GovRAMP's Q1, Q2 2026 changelog bundles a 3PAO discount program spanning ten assessment firms, federal overlay templates for Low through High Impact levels, a framework harmonization policy, and an AI Self-Reporting Addendum that asks service providers to disclose architecture and governance practices on AI-enabled products. Contractors pursuing authorization face lower assessment costs; state and municipal procurement teams gain standardized evaluation tools and AI visibility. The consolidation of cost relief, framework alignment, and AI transparency in a single release cycle moves GovRAMP beyond program-building toward operational parity with federal requirements.
JUL 26
regulator
GovRAMP Publishes Authorization Playbook Without Sponsorship SLA
A documented playbook replaces opaque criteria, but the government sponsorship requirement, the gate that decides listing, still has no published timeline.
GovRAMP has published a formal 8-step process for achieving Authorized or Provisionally Authorized status. The pathway requires a 3PAO-conducted Security Assessment Report, full documentation, and either government sponsorship or approval through the GovRAMP Approvals Committee. The codification replaces previously opaque criteria with a documented playbook, but the sponsorship requirement, the step that determines whether a product appears on the Authorized Product List, carries no published SLA. Vendors gain a documented path but no timeline for the gatekeeping step.
JUL 26
regulator
Arizona Retires AZRAMP for GovRAMP NIST 800-53
The migration makes Arizona the third state to abandon a proprietary cloud security program for the national GovRAMP framework, with hard compliance deadlines beginning July 2025 for new contracts.
Arizona is sunsetting its AZRAMP cloud security program and migrating all vendor authorizations to GovRAMP, requiring NIST 800-53-based assessments for new state contracts starting July 1, 2025, and for renewals by July 1, 2026. Existing AZRAMP authorizations remain valid until they expire, but there will be no further AZRAMP renewals. At expiration, vendors must hold GovRAMP or FedRAMP status. Arizona becomes the third state to fold its homegrown assessment regime into the GovRAMP umbrella, accelerating the consolidation away from state-by-state cloud security programs.
JUL 26
regulator
Minnesota mandates GovRAMP moderate authorization for cloud vendors
The fourth state to adopt the FedRAMP-modeled framework as a procurement requirement, and Minnesota's version is notably rigid: SOC 2, ISO 27001, and TX-RAMP won't substitute.
Minnesota now requires GovRAMP moderate-impact authorization for cloud products processing high-risk state data. Vendors must submit a Snapshot score within 60 days of contract execution and achieve full authorization by April 1, 2027. Scores below 100% trigger mandatory enrollment in a remediation program with quarterly re-scoring, monthly advisory calls, and continuous monitoring access granted to Minnesota IT Services. SOC 2, ISO 27001, HITRUST, and TX-RAMP are explicitly rejected as substitutes; only GovRAMP or FedRAMP Rev 5 counts. Minnesota is the fourth state to mandate the framework in procurement.
JUL 26
regulator
Chandler mandates GovRAMP authorization within 18 months for cloud contractors
Chandler is the first municipal government to make GovRAMP authorization a binding contract term, Ready in 12 months, Authorized in 18, or the deal's off.
The City of Chandler now requires cloud service contractors handling city data to achieve GovRAMP Ready status within 12 months of contract execution and full Authorized status within 18 months. Contractors without either designation at signing must submit a Security Snapshot within three months and provide monthly progress reports. Chandler sponsors contractors through the process, but missing the 18-month deadline means breach of contract, and likely termination. Chandler, a GovRAMP participant since 2022, is the first municipality to mandate the framework across all cloud products at category-level specificity.
JUL 26
regulator
GovRAMP releases adoption guide for state and local agencies
The guide treats GovRAMP adoption as an organizational problem, not a standards one; the framework is no longer the bottleneck.
GovRAMP published an Adoption Guide to help state and local agencies implement its standardized cloud security framework. The guide covers four adoption models (Require, Hybrid, Prefer, and Accept) aligned to organizational maturity, and provides a roadmap for building an implementation plan. The publication signals program maturation: GovRAMP spent its early years defining the framework; the guide treats adoption as an organizational problem, not a standards one.
JUL 26
regulator
Texas DIR Codifies GovRAMP-TX-RAMP Reciprocity
The policy update means cloud vendors can satisfy state requirements with a single GovRAMP credential, but DIR notification is still mandatory and the recognition doesn't flow both ways.
Texas DIR has updated the TX-RAMP Program Manual to formally recognize GovRAMP authorizations and the Progressing Security Snapshot Program as meeting state cloud security requirements. GovRAMP Ready or Authorized products now receive automatic TX-RAMP certification via a weekly automated sync. Products in the Progressing Snapshot Program qualify for TX-RAMP Provisional without the standard 18-month expiration. A one-time Security Snapshot also qualifies but carries the 18-month cap. DIR still requires a TX-RAMP Request Form, and the reciprocity is one-directional: TX-RAMP certification doesn't confer GovRAMP standing.
JUL 26
regulator
Oregon adopts GovRAMP for state cloud security vetting
Vendors may need Authorized status, interim badges may satisfy requirements, but Oregon hasn't said how fast or what happens if they don't.
Oregon has adopted GovRAMP (the FedRAMP-aligned, NIST SP 800-53 moderate verification framework) as its mechanism for vetting cloud service offerings in covered procurements. The policy states Oregon "may require" a vendor to reach GovRAMP Authorized status within a defined post-contract timeframe; interim designations "may be accepted" as placeholders until full authorization is achieved. Oregon is one of eleven states now using the program, which is vendor-funded and includes continuous monitoring for the contract lifecycle. The conditional language leaves the enforcement clock and any penalties unspecified.
JUL 26
regulator
North Carolina Cloud Contracts Require GovRAMP by April 1
Six weeks out from the deadline, North Carolina hasn't specified which GovRAMP tier satisfies its new cloud contract mandate.
North Carolina's Department of Information Technology will require GovRAMP authorization for all new executive-branch contracts with cloud components starting April 1, 2026. The mandate, announced February 18, aligns with NIST 800-53 security controls and applies to IaaS, PaaS, and SaaS providers. Authorization is transferable across state agencies: a vendor verified once can serve any participating North Carolina agency. But with roughly six weeks between announcement and deadline, and no word yet on which GovRAMP tier satisfies the requirement, vendors without a prior FedRAMP or state authorization face a narrow path.
JUL 26
regulator
Nevada Mandates GovRAMP Core for Cloud Contracts
Nevada's new cloud security mandate requires GovRAMP Core. SOC 2, ISO 27001, TXRAMP, and HITRUST won't cut it.
Starting July 1, 2026, all new Nevada executive-branch cloud contracts must include GovRAMP Core certification at minimum, the state's Government Technology Office announced. The mandate, built on NIST SP 800-53 Rev 5, covers all three cloud service models. Vendors get a 12-month on-ramp from contract execution to achieve Core; FedRAMP Rev 5 holders can use a Fast Track process. As of July 1, 2028, the on-ramp disappears. Nevada explicitly rejects TXRAMP, SOC 2, ISO 27001, and HITRUST as substitutes.
JUL 26