Scrutineer · By framework

AZRAMP certification software for the move to GovRAMP

Arizona has stopped renewing AZRAMP. New state contracts already require GovRAMP-aligned assessments, renewals do from July 1, 2026, and the state now accepts only a GovRAMP or FedRAMP status, not SOC 2, ISO 27001, HITRUST or TX-RAMP.

Scrutineer holds your NIST 800-53 controls and evidence once, shows what your existing reports already cover, and tracks the AZRAMP expiry and GovRAMP windows on one timeline.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with AZRAMP

Your SOC 2 report no longer counts with Arizona

This is the line most vendors miss. The GovRAMP Arizona program page states that AZRAMP "will only be accepting GovRAMP or FedRAMP," and it names what is not accepted: TX-RAMP, SOC 2, ISO 27001 and HITRUST. It also says, in as many words, that TX-RAMP compliance does not grant a GovRAMP status. So a SaaS company holding a clean SOC 2 Type 2 and a TX-RAMP Level 2 certificate, which is a strong position in most states, has nothing Arizona will take on its own. The good news is in the controls rather than the paperwork. SOC 2, ISO 27001 and TX-RAMP evidence covers a large share of what a GovRAMP package tests, because all of it traces back to NIST SP 800-53. The work is mapping and filling the gaps, not starting over.

An active AZRAMP status runs out and cannot be renewed

Arizona is not revoking existing approvals. If you hold an active AZRAMP status you can keep using it until it expires. What changes is the renewal: no further AZRAMP renewals are issued, and at expiration you need an appropriate GovRAMP or FedRAMP status as defined by the Arizona Department of Homeland Security. Two dates frame that. Since July 1, 2025, new state contracts carry risk assessment requirements aligned with GovRAMP. From July 1, 2026, renewal contracts carry them too. Every AZRAMP listing shows an expiration date, so the real deadline for your product is printed next to its name on the state vendor list. Teams that read it late find themselves starting a GovRAMP package in the same quarter as a contract renewal.

No state data moves until you are in the Progressing Snapshot

Arizona does not wait for a finished authorization before it cares. If your product has no verified GovRAMP status, the state requires you to participate in the GovRAMP Progressing Snapshot program before any data is transferred, and it expects progress every quarter. A GovRAMP PMO letter showing an Active, In Process or Pending status can stand in, and a GovRAMP letter goes in with your solicitation response either way. After award the clock is explicit: Core, where the state requires it, within 12 months; Ready in a window of 12 to 18 months; Authorized in a window of 18 to 24 months. Continuous monitoring then runs monthly or quarterly for the life of the contract. That is a procurement schedule, and it fails on evidence that is not ready, not on controls that are not there.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Holds one NIST SP 800-53 Rev. 5 control library and maps it to GovRAMP Core, Ready and Authorized, so the Arizona move is a gap list rather than a rebuild
Shows which of your existing SOC 2, ISO 27001, HITRUST and TX-RAMP evidence already answers GovRAMP controls, and which controls have nothing behind them
Keeps the System Security Plan current, because Arizona asks for an SSP or a WISP before it will evaluate your product
Tracks your AZRAMP expiration date against the Core, Ready and Authorized windows that start at contract award
Keeps a live POA&M and evidence trail so the quarterly progress Arizona expects during the Progressing Snapshot is an export, not a scramble
Schedules monthly or quarterly continuous monitoring for the full contract lifecycle once a milestone status is reached
Flags the cloud products you rely on to deliver the service, since Arizona may require a GovRAMP or FedRAMP assessment of those too
Reuses the same evidence for TX-RAMP, FedRAMP, SOC 2 and ISO 27001, because the state programs test the controls your other frameworks already test

AZRAMP readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Arizona transition reference

What Arizona accepts from the security status you already hold

Published AZRAMP guides still describe how to get an AZRAMP approval, which Arizona no longer renews. The question in front of a vendor today is narrower: which of the reports already in your evidence room does the state accept, and what has to be filed before the date that matters. This table runs on the GovRAMP Arizona program rules.

What you hold today	Does Arizona accept it	What the state needs next	What you still have to file
An active AZRAMP status	Yes, until its expiration date	No AZRAMP renewal. A GovRAMP or FedRAMP status before it expires	Start a Progressing Snapshot now so a status exists when the AZRAMP date passes
An AZRAMP status that has already expired	No	Progressing Snapshot participation before any state data is transferred	A GovRAMP security package and the PMO letter with your next solicitation response
A SOC 2 Type 2 report	No, named as not accepted	A GovRAMP or FedRAMP status sized to the impact level of the procurement	Map your SOC 2 evidence to NIST 800-53 and fill the gaps for the GovRAMP package
ISO 27001 certification	No, named as not accepted	The same GovRAMP or FedRAMP status	Annex A evidence carried into the GovRAMP control set, plus an SSP or WISP
A HITRUST certification	No, named as not accepted	The same GovRAMP or FedRAMP status	A GovRAMP package. HITRUST evidence maps well, but the certificate does not transfer
TX-RAMP Level 1 or Level 2	No. TX-RAMP compliance does not grant a GovRAMP status	A GovRAMP or FedRAMP status	A GovRAMP package built from the same 800-53 evidence Texas already reviewed
A FedRAMP authorization	Yes, recognized directly	Nothing new for the status itself	Optionally GovRAMP Fast Track, which accepts your FedRAMP package with no new audit
GovRAMP Core, Ready or Authorized	Yes	Whatever higher status the contract specifies, inside its 12, 18 or 24 month window	Continuous monitoring, monthly or quarterly, for the life of the contract

Reflects the GovRAMP Arizona program page as read in October 2026 and the Arizona Department of Homeland Security AZRAMP vendor list. The state sets the required status per procurement and grace periods per solicitation, so confirm your own contract terms with ADOHS and GovRAMP before you file. Scrutineer prepares readiness evidence and does not award any of these statuses.

Good questions

Questions about AZRAMP

AZRAMP is the Arizona Risk and Authorization Management Program, the Arizona Department of Homeland Security's NIST-based security assessment for cloud products sold to state agencies. Modeled on FedRAMP, it had vetted more than 450 cloud service products by September 2025, according to the state. Arizona is now transitioning it to GovRAMP, formerly StateRAMP.

Yes. Arizona is officially transitioning AZRAMP to StateRAMP, now called GovRAMP. Since July 1, 2025, new state contracts include risk assessment requirements aligned with GovRAMP, and from July 1, 2026 renewal contracts include requirements aligned with GovRAMP or FedRAMP. Arizona now accepts only a GovRAMP or FedRAMP status.

Not as a new or renewed approval. Arizona states it will issue no further AZRAMP renewals, and new contracts already require GovRAMP-aligned assessments. An active AZRAMP status stays usable until its expiration date. After that, the product needs an appropriate GovRAMP or FedRAMP status as defined by the Arizona Department of Homeland Security.

No. The GovRAMP Arizona program page lists TX-RAMP, SOC 2, ISO 27001 and HITRUST as not accepted. Those reports still help, because their evidence overlaps heavily with the NIST SP 800-53 controls GovRAMP tests, but the certificate itself does not satisfy Arizona. You need a GovRAMP or FedRAMP status.

No. Arizona states that TX-RAMP compliance does not grant a GovRAMP status, so a Texas certification does not satisfy an Arizona contract. The underlying evidence carries over well, since both programs are built on NIST SP 800-53, which makes a GovRAMP package for Arizona a mapping exercise for a TX-RAMP certified vendor rather than a new program.

It stops counting. You can use an active AZRAMP status until its expiration date, which appears on the state vendor list, but Arizona will not renew it. To keep selling, you need a GovRAMP or FedRAMP status by then, or at minimum Progressing Snapshot participation, which Arizona requires before any state data is transferred.

It depends on the procurement. The Arizona Department of Homeland Security selects the risk assessment level for each contract based on the impact level of the data. After award, Core, where required, is due within 12 months, Ready in a window of 12 to 18 months, and Authorized in a window of 18 to 24 months.

It is GovRAMP's program for products that do not yet hold a verified status. Arizona requires a product without one to participate in the Progressing Snapshot before any state data is transferred, and expects quarterly progress. A GovRAMP PMO letter showing an Active, In Process or Pending status can be provided instead, and a GovRAMP letter must accompany solicitation responses.

Arizona sets no separate fee. The cost is GovRAMP's. On its fee schedule effective January 1, 2025, a provider under 1 million dollars in revenue pays a PMO fee of 3,500 dollars for Ready or 4,500 dollars for Authorized, plus dues and a separately billed third party assessor. Core is quoted between 9,000 and 21,000 dollars depending on the GovRAMP page, with no assessor.

Yes. Arizona recognizes FedRAMP authorizations alongside GovRAMP. If you also want a GovRAMP listing, GovRAMP Fast Track accepts the FedRAMP package you already have without a new audit. Under the FedRAMP Consolidated Rules for 2026 the old Moderate label is now Class C, so check that state paperwork names the right baseline.

No. Scrutineer is readiness software, not a third party assessment organization, a program management office or a state authorizing body. GovRAMP and the Arizona Department of Homeland Security decide status. Scrutineer holds the controls, SSP and evidence those bodies ask for, maps them across GovRAMP, TX-RAMP, FedRAMP and SOC 2, and keeps continuous monitoring current.

Read every compliance and risk question

Keep reading

Guides that go deeper on this framework

GovRAMP certification cost and TX-RAMP pricing

The published GovRAMP fee schedule, what the 3PAO adds on top, and why Core is cheaper than it looks.

Read the guide

GovRAMP vs StateRAMP, and vs FedRAMP

What the 2025 rename changed, the full status ladder, and how reciprocity between the programs works.

Read the guide

TX-RAMP certification cost

Why Texas charges nothing, where the real cost sits, and how the same evidence carries into GovRAMP.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification