Fishers First City to Adopt GovRAMP Procurement Preference

The City of Fishers will give preferential contract awards to cloud service vendors that comply with GovRAMP certification requirements beginning January 1, 2024. The policy applies to all new cloud service contracts and renewals on or after that date. Vendors without an existing GovRAMP Ready, Authorized, or Provisional designation must, at minimum, enroll in the Progressing Snapshot Program, a self-attestation that serves as an on-ramp toward full authorization. The city's Business Solutions Group and IT departments jointly determine which services fall in scope, using NIST SP 800-145's cloud computing definition and excluding categories like GIS mapping, social media, training platforms, and general productivity tools from the GovRAMP preference.

Fishers is the first municipality to adopt GovRAMP as a procurement criterion, and that's the story. GovRAMP, a 501(c)(6) nonprofit founded in 2020, has spent its early years building adoption at the state level, working through NASPO and NASCIO to develop standardized solicitation language, procurement workflows, and a NIST 800-53-aligned verification model. The pitch is "verify once, serve many": a vendor that achieves GovRAMP authorization can carry that credential across any participating government member. That reciprocity model is the program's entire value proposition for vendors, who otherwise face duplicative security reviews for every agency contract. State-level adoption validates the concept in large procurement shops; municipal adoption tests whether the model generates enough market pressure to change vendor behavior when the buyer is a city of roughly 100,000 people.

For cloud vendors selling into Fishers, the Monday-morning question is whether "preference" operates as a soft nudge or a backdoor mandate. The policy language says preferential awards, not mandatory certification. But the practical gap between preference and requirement narrows quickly when competitors enroll. The GovRAMP procurement toolkit, developed with NASPO, includes an exemption policy for situations where no certified product meets requirements or where certified options are cost-prohibitive. Fishers hasn't yet indicated how it will apply exemptions in practice. That ambiguity will define whether the policy drives vendors into the program or simply adds a checkbox to the RFP response.