New State Cloud Rules Will Impact Vendors

For vendors who sell to the public sector, there are new rules in multiple states.

For example, since April, new North Carolina contracts that have a cloud component require a risk assessment aligned with GovRAMP, the state level version of FedRAMP. GovRAMP was previously known as StateRAMP. Vendors MAY receive a waiver for one year, but by then they have to be compliant.

Texas has a similar law. Since Texas is special, they have their own version of GovRAMP. They call it TX-RAMP, but it is the same thing. If a company wants to do business in Texas and they are either GovRAMP or FedRAMP certified they may request an exemption, but it is not automatic.

Indiana’s GovRAMP requirement went into effect on Oct 14, 2025 for new, amended or renewed contracts.

Nevada added the GovRAMP requirement just a couple of months ago, on July 1, 2026.

And, of course, it depends on the system, the state and the kind of data that you are dealing with.

But the universal message here is that we don’t trust you to audit yourself. If you want to do business with us, you need a third party assessment. The feds are well on their way to do this with the new FAR CUI rule, expected to be out late this year or early next year.

That also means that you as a vendor need to understand what data you collect, what you do with it and where you store it. Also how long you keep it.

Also, we have seen some vendors say that their server (or virtual server) is in a fedRAMP data center, so we are good. WRONG! Trying that will be a fail for you.

And, if you connect to other systems that are not directly part of your infrastructure, they may have to be compliant as well.

A couple more things.

If you are a service vendor as opposed to a software or product vendor, North Carolina’s rules include you. That means that if you store data associated with the contract in the cloud, that cloud vendor better be *RAMP (state, TX, Fed) certified.

Also, just because you sold to the state in the past (or current) does not give you a free pass. When the contract renews, you need to meet the requirements.

These certifications are not free. GovRAMP itself charges a $10k annual fee. That is separate from any money you need to spend to get compliant and to prove you are compliant.

If you are selling into the public sector, these are things you need to understand.

If you need assistance, please contact us.

Credit: Route Fifty

by