The Broadside
Watch hubsRSS →

Watch hub·govramp · stateramp · tx-ramp · ny-dfs-500

State & Local

GovRAMP, state cyber and privacy laws, municipal compliance, and the patchwork below the federal line.

Updated ·RSS ↗

States and municipalities are building their own cybersecurity regimes for vendors handling state and local data. GovRAMP (formerly StateRAMP) is the dominant cross-state framework; TX-RAMP, NY DFS Part 500, and CJIS run alongside it. This hub indexes those programs, tracks alignment (and divergence) with federal frameworks, and surfaces state-level enforcement and policy movement.

What changed in the last 30 days

  • municipal/trade-press

    Vicksburg, Miss. city systems down after ransomware attack

    A ransomware attack has forced Vicksburg, Mississippi to shut down city computer systems, Mayor Willis Thompson confirmed Thursday. Emergency services are unaffected, but utility payment processing is down, though Thompson said no services will be cut off and no late penalties will apply during the outage. The FBI, DHS, and state officials are involved in the response alongside private cybersecurity experts. The city declined to comment on whether a ransom was demanded or which group is responsible. The mayor said no determination has been made yet on whether personal data was compromised.

  • cjis/trade-press

    CJIS 2027 deadline pushes identity past MFA

    The FBI's Criminal Justice Information Services Division has updated its Security Policy with an October 2027 compliance deadline, and public safety agencies are being told to move beyond multifactor authentication toward consistent identity governance, third-party access controls, and centralized accountability. The warning comes from an industry practitioner, not the Bureau itself, but the operational picture is familiar: officers accessing up to 10 systems per shift, cumbersome authentication that users circumvent, and agencies that treat compliance as a last-minute audit exercise rather than a security foundation.

Open questions

  • 01Which states are next to mandate a vendor authorization regime?
  • 02How aligned is GovRAMP's revised baseline with FedRAMP 20x?
  • 03How do state privacy laws and CJIS interact with federal CUI handling for cross-jurisdictional vendors?

Sources we watch

Earlier coverage