Chandler mandates GovRAMP authorization within 18 months for cloud contractors

The City of Chandler has published its GovRAMP determination (1): any contractor storing, processing, or transmitting city data in external cloud environments must achieve GovRAMP Authorized status. And they're on a clock. Ready status is required within 12 months of contract execution; full Authorized status within 18 months. Contractors that haven't reached either milestone at signing get a tighter leash: a GovRAMP Security Snapshot due within three months, plus monthly progress reports to GovRAMP until they hit Ready or Authorized. The city provides sponsorship, but the consequence of missing the 18-month Authorized deadline isn't ambiguous: breach of contract, and the engagement likely ends.

That's not guidance. That's a contractual requirement.

Chandler joined GovRAMP in 2022, one of 72 participating government organizations now listed on the GovRAMP roster (3). For three years, that membership sat in the "exploration, planning, or active implementation" category, the standard disclaimer GovRAMP attaches to every participant listing. This determination changes that. Chandler has moved from exploration to enforcement, and it's done so across all cloud products at the security category level the city specifies for each engagement. That's the granularity that matters: not just "get GovRAMP," but "get Authorized at the category level this contract demands."

The precedent that travels

Other cities and states are watching. GovRAMP's participant list already includes Sacramento County, Arapahoe County, the State of Arizona, the State of Alabama, and dozens of K-12 education cooperatives. Most are still in the exploration phase. Chandler's determination gives them a template. Not just the policy language (GovRAMP and NASPO already offer standardized solicitation and contract clauses through the Procurement Cloud Security Resource Tool), but the operational reality of a deadline with teeth.

The progressive model GovRAMP uses (Membership, Single Security Snapshot, Progressing Snapshot, Core, Ready, Authorized) was designed to give governments a way to adopt the framework without shutting out vendors who aren't verified yet (6). Chandler is using the full pathway: the Security Snapshot and monthly reporting keep contractors accountable during the ramp-up, and the sponsorship provision means the city has skin in the game.

What isn't settled

One question the determination doesn't answer: whether the 12/18-month clock applies retroactively to existing contracts or only to new procurements. The language references "Agreement execution," which points forward, but contractors currently serving Chandler under pre-existing terms should clarify their status directly. The city's Bidding Opportunities page on GovRAMP lists current solicitations, suggesting new awards are the primary mechanism, but the determination page doesn't carve out legacy contracts explicitly.

For cloud service providers eyeing Chandler business, or any municipal contract in a GovRAMP-participating jurisdiction, the move is to start the Security Snapshot now. The three-month window for unverified contractors is short, and monthly reporting starts immediately after. GovRAMP's office hours (first Wednesday of each month) are the entry point for questions. Waiting for a solicitation to drop before beginning the verification process is, at this point, a decision to start the clock already behind.