Scrutineer · By framework

Georgia GovRAMP compliance for GTA cloud vendors

Georgia now buys cloud services on GovRAMP status. New state contracts with a cloud component have carried GovRAMP requirements since October 1, 2026, and from July 1, 2027 full verification is mandatory for every procurement with a cloud piece.

Scrutineer holds your NIST 800-53 controls and evidence once, shows which GovRAMP status each Georgia data class demands, and tracks every contract's window on one timeline.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with GA GovRAMP

Your highest data class sets the status and the clock

Georgia standard SS-26-003, issued October 1, 2026, ties the minimum GovRAMP status to the highest class of state data your service touches. Public data needs a GovRAMP Security Snapshot Score validated before award. Internal data needs GovRAMP Core, Confidential data needs Ready and Restricted data needs Authorized, each either at award or within 12, 18 or 24 months under an approved interim authorization. Restricted includes FTI, SSNs, PHI, CJIS and PCI data and state employee HR records, so plenty of ordinary HR and payments SaaS lands at the top tier.

FedRAMP counts only through GovRAMP reciprocity

A FedRAMP authorization can satisfy a Georgia requirement, but only when it is active and in good standing, its system boundary matches the service the state will use, and GovRAMP recognizes it through its reciprocity process. The standard tells agencies not to accept FedRAMP Ready or In Process designations, or vendor claims of FedRAMP alignment without verifiable authorization. SOC 2, ISO 27001 and HITRUST are not mentioned in the standard at all, so on their own they do not meet any Georgia tier.

The status must cover the exact product you sell

Georgia validates the product and its authorization scope, not the company. A GovRAMP status held by your parent, an affiliate, another of your products or your infrastructure provider does not carry over, and the requirement also reaches any cloud service you run on that handles state data. Existing contracts pick up the rule at renewal, extension, major modification or new solicitation, and if the service later handles more sensitive data, the agency has to reassess before that data moves.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Holds one NIST SP 800-53 Rev. 5 control library and maps it to GovRAMP Core, Ready and Authorized, so the Georgia requirement becomes a gap list rather than a new program
Records the highest Georgia data class each contract allows, Public, Internal, Confidential or Restricted, and shows the GovRAMP status and window that class triggers
Tracks the 12, 18 and 24 month windows from each contract award, plus the milestones and compensating controls your interim authorization commits to
Keeps the System Security Plan, POA&M, inventory workbook and scan records current, the artifacts Georgia contracts let agencies request for continuous monitoring
Documents your authorization boundary, so an agency can see that the status you cite covers the exact offering it is buying
Lists the cloud services underneath your product that touch state data, because Georgia applies the same requirement to them
Shows which SOC 2, ISO 27001 and HITRUST evidence already answers GovRAMP controls, and which controls have nothing behind them yet
Reuses the same evidence for North Carolina, Arizona, Texas, FedRAMP and SOC 2, because each of those programs tests NIST 800-53 controls you already hold

GA GovRAMP readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Georgia standard reference

What Georgia requires for each class of state data

Most GovRAMP guides explain the status ladder in general. Georgia wrote its own minimums on top of it in SS-26-003 and classifies data in SS-26-002. This table runs on those two documents.

What the service holds or has	What Georgia requires	By when	What carries you meanwhile
Public data only, such as press releases and published policies	A GovRAMP Security Snapshot Score	Validated before contract award	Nothing interim, the score is the requirement
Internal data, such as internal email, drafts and administrative records	GovRAMP Core	At award, or within 12 months	An interim authorization with milestones and compensating controls
Confidential data, such as HR and financial data, source code and security configurations	GovRAMP Ready	At award, or within 18 months	An interim authorization, often supported by the Progressing Snapshot program
Restricted data, such as FTI, SSNs, PHI, CJIS, PCI and state employee HR records	GovRAMP Authorized	At award, or within 24 months	An interim authorization, reviewed throughout the period
A FedRAMP authorization in good standing with a matching boundary	Accepted only through GovRAMP reciprocity	Before award or service use	The GovRAMP status that reciprocity produces
FedRAMP Ready, FedRAMP In Process or a claim of FedRAMP alignment	Not accepted	Not applicable	A GovRAMP status sized to the data class above
A SOC 2, ISO 27001 or HITRUST report alone	Not named anywhere in the standard	The status for your data class still applies	Map the evidence to NIST 800-53 and file the GovRAMP package
Reports, exports and AI outputs built from state data	Inherit the highest class of the source data	Unless formally reclassified	Count them when you size the data class

Reflects Georgia Technology Authority policy PS-26-001, standard SS-26-003 and guideline GS-26-001, all issued October 1, 2026, the data classification standard SS-26-002 and the GTA GovRAMP adoption page, as read in October 2026. Each solicitation sets the exact terms, so confirm yours with the purchasing agency or GTA. Scrutineer prepares readiness evidence and does not award any status.

Good questions

Questions about GA GovRAMP

Yes, for third-party cloud services that handle state data for executive branch agencies. Since October 1, 2026, new state procurements with a cloud component carry GovRAMP-aligned requirements, and services bought through GTA enterprise IT procurement go through GovRAMP validation and GTA approval. From July 1, 2027, full GovRAMP verification is mandatory for all such procurements.

It depends on the highest class of state data in the service. Public data needs a GovRAMP Security Snapshot Score validated before award. Internal data needs GovRAMP Core, Confidential data needs GovRAMP Ready and Restricted data needs GovRAMP Authorized. Agencies may require a higher status when risk, mission impact or regulation warrants it.

Under an approved interim authorization, you have 12 months from contract award to reach Core, 18 months to reach Ready and 24 months to reach Authorized. The interim authorization documents your current status, the risk, your remediation milestones and compensating controls, and the agency reviews progress throughout. It does not waive the final requirement.

Only through GovRAMP reciprocity. The FedRAMP authorization must be active and in good standing, its scope must match the service the state uses, and GovRAMP must recognize it through its reciprocity process. Georgia agencies are told not to accept FedRAMP Ready or In Process designations, or unsupported claims of FedRAMP alignment.

No. Standard SS-26-003 does not mention SOC 2, ISO 27001 or HITRUST at all. It names GovRAMP status, FedRAMP through GovRAMP reciprocity, or another framework that GovRAMP recognizes through its own reciprocity or equivalency process. Your SOC 2 evidence still helps, because most of it maps to the NIST 800-53 controls GovRAMP tests.

Yes, at renewal, extension, major modification or new solicitation. GTA says existing contracts containing cloud services align with the GovRAMP verification requirements at those points. If a service will start handling more sensitive data than originally approved, the agency must reassess the required status before that data is processed.

Yes. The standard applies to any cloud service that processes, stores or transmits state data, whether you operate it or another cloud provider you use does. Agencies also check that the status covers the exact product and system boundary, so a status held by your hosting provider or an affiliate does not stand in for yours.

The standard defines agency to exclude the judicial and legislative branches, the Georgia Department of Defense, departments headed by elected constitutional officers and the University System of Georgia. It also does not cover systems hosted in state data centers, or vendors that use cloud tools only for their own operations without handling state data.

An interim authorization is the time-limited permission SS-26-003 itself provides while you progress toward the required status. A policy exception is a separate approval to deviate from the standard and follows the state exception process. Georgia guidance warns that an interim authorization should never become an indefinite alternative to reaching the status.

Georgia's policy documents set no separate state fee. Your cost is GovRAMP membership, the program fee for the status you need and, for Ready or Authorized, a third party assessment organization billed separately. GovRAMP tiers its fees by company revenue, which our GovRAMP cost guide breaks down.

No. Scrutineer is readiness software, not a third party assessment organization, the GovRAMP program office or GTA. GovRAMP verifies status and the agency or GTA approves the service. Scrutineer holds the controls, SSP, POA&M and evidence those bodies ask for and tracks every Georgia contract window on one timeline.

Read every compliance and risk question

Keep reading

Read before you price a Georgia bid

GovRAMP certification cost and TX-RAMP pricing

The published GovRAMP fee schedule, what the 3PAO adds on top, and why Core is cheaper than it looks.

Read the guide

GovRAMP vs StateRAMP, and vs FedRAMP

What the 2025 rename changed, the full status ladder, and how reciprocity works.

Read the guide

FedRAMP 20x vs Rev 5 requirements

Which federal route GovRAMP reciprocity can build on, and what each costs in time.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification