Scrutineer · By framework

Indiana RAMP policy compliance for state cloud vendors

Indiana wrote GovRAMP into the executive branch's cloud buying with its RAMP policy, effective October 14, 2025. Any cloud contract executed, amended or renewed after that date carries a minimum GovRAMP status, a deadline to reach it, and quarterly proof that you still meet it.

Scrutineer holds your NIST 800-53 Rev. 5 controls and evidence once, works out which status each Indiana contract needs from both policy matrices, and tracks the window and the quarterly evidence the Indiana Office of Technology reviews.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with IN RAMP

Two matrices decide your status, and the higher one wins

Indiana picks the minimum GovRAMP status with a data matrix and a critical infrastructure matrix, then applies whichever is higher. Nonconfidential data alone means Core at the Moderate Impact level. Confidential data such as PII, PHI, FTI, PCI data, education or unemployment records means Authorized, and CJIS data means Authorized plus the CJIS overlay. Separately, a product that supports critical infrastructure, which the policy says includes hospitals, banks and essential government services, needs Authorized even when the data is not confidential.

The clock is 18 months or half the term, and the sources differ

Policy P.05 gives you a reasonable date certain, not to exceed 18 months from the effective date of the contract or one half of its term, whichever is shorter. A two year contract therefore allows 12 months. The Indiana Office of Technology page says 12 to 18 months depending on data type and system criticality, and the GovRAMP Indiana page says up to 18. Treat the contract language as the answer and the short term rule as the one that can bite.

Quarterly evidence, 30 day notices and termination

Meeting the status once is not enough. You must keep meeting it for the life of the contract as determined by a maturity assessor, with evidence sent to the agency and IOT at least quarterly. If a product falls below the level, the agency must tell IOT within 30 days, and contracts can be terminated where the failure is not fixed on a timeline IOT accepts.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Holds one NIST SP 800-53 Rev. 5 control library, the framework Indiana names, so Core and Authorized become gap lists rather than a new program
Records data type and critical infrastructure support per contract, so the higher of the two matrix results is visible before you bid
Tracks the 18 month or half-term deadline from each contract execution date, amendment or renewal on one timeline
Keeps the quarterly evidence package ready, since Indiana agencies must receive proof of continued compliance at least every quarter
Stores Progressing Snapshot scores and updates, the interim status Indiana requires until you reach the minimum level
Keeps your System Security Plan or Written Information Security Program current, the document Indiana asks for instead of a SOC 2 report
Shows which SOC 2, ISO 27001 and HITRUST evidence already answers NIST 800-53 controls, and which controls have nothing behind them
Reuses the same evidence for Minnesota, North Carolina, Georgia, Nevada, Arizona, Texas and FedRAMP, because each tests controls you already hold

IN RAMP readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Indiana requirement reference

What Indiana requires, by data and by what you support

Most GovRAMP guides list one ladder. Indiana runs two matrices and takes the higher result, so a product with harmless data can still need Authorized. This table runs on Indiana policy P.05 and the Indiana Office of Technology and GovRAMP program pages.

What your product handles or holds	Minimum status Indiana sets	What you owe the state	Deadline
Nonconfidential data, no critical infrastructure	GovRAMP Core at the Moderate Impact level	Quarterly proof of continued compliance, risk assessment and continuous monitoring	18 months or half the contract term, whichever is shorter
Confidential data such as PII, PHI, FTI, PCI data or education records	GovRAMP Authorized at the Moderate Impact level	The same quarterly evidence and monitoring	18 months or half the term, whichever is shorter
CJIS data	GovRAMP Authorized plus the CJIS overlay	The same, plus the CJIS Security Policy controls	18 months or half the term, whichever is shorter
Nonconfidential data but the product supports critical infrastructure	GovRAMP Authorized, because the higher matrix result wins	The same quarterly evidence and monitoring	18 months or half the term, whichever is shorter
No GovRAMP status at signing	Interim only: Progressing Snapshot enrollment	Sign up as a GovRAMP member and submit the Snapshot, which is enough for contract signature	Enrolled until the minimum status is reached
FedRAMP Rev. 5 authorized or in process	Accepted, but only through GovRAMP Fast Track	The same security package, no new 3PAO, so IOT gets continuous monitoring	Enroll after award
A SOC 2, ISO 27001, HITRUST or TX-RAMP report	Not accepted on its own	The GovRAMP path above, plus your SSP or WISP for evaluation	Same as having no status
A contract signed before October 14, 2025	Not covered until a new solicitation or any amendment, change order or extension needing IOT approval	Whatever the new action sets	Runs from that contract action

Reflects Indiana RAMP policy P.05, the Indiana Office of Technology RAMP at-a-glance page and the GovRAMP State of Indiana page, as read in October 2026. The sources differ on the window, so each contract and solicitation sets the exact terms. Confirm yours with the purchasing agency or IndianaRAMP@iot.in.gov. Scrutineer prepares readiness evidence and does not award any status.

Good questions

Questions about IN RAMP

Yes, in effect. The Indiana RAMP policy, issued under Executive Order 25-19, sets minimum verified security levels called GovRAMP statuses for cloud offerings. It applies to contracts executed, amended or renewed on or after October 14, 2025, for executive branch agencies and entities connected to the state's systems or network.

Core, Authorized, or Authorized plus the CJIS overlay, all at the Moderate Impact level. Nonconfidential data needs Core, confidential data needs Authorized, and CJIS data needs the overlay. A second matrix on critical infrastructure can raise the result to Authorized, and agencies must pick the higher of the two.

Policy P.05 says no more than 18 months from the contract effective date or one half of its term, whichever is shorter. Indiana Office of Technology guidance says 12 to 18 months depending on data type and criticality. Providers without a status must stay in the Progressing Snapshot program until they reach the minimum.

No. The GovRAMP Indiana page says IOT accepts only GovRAMP or FedRAMP Rev. 5 and lists TX-RAMP, SOC 2, ISO 27001 and HITRUST as not accepted, citing NIST as the framework it must assess against. It asks for your System Security Plan or WISP. Your SOC 2 evidence still helps, since most of it maps to NIST 800-53.

Yes, FedRAMP Rev. 5, through GovRAMP. A product that holds or is seeking a FedRAMP Rev. 5 status must enroll in the GovRAMP Fast Track program. You do not re-engage a 3PAO, you submit the same security package to the GovRAMP program office, which lets Indiana get the continuous monitoring Executive Order 25-19 requires.

No. GovRAMP offers reciprocity with TX-RAMP, but Indiana says TX-RAMP compliance does not give you a GovRAMP status and lists it as not accepted. A Texas certified product still needs its own GovRAMP path to meet an Indiana contract, although the NIST 800-53 work behind the Texas certification shortens it.

Indiana says steps one and two are enough to sign: become a GovRAMP member and submit the Progressing Snapshot request. You are then listed as progressing, receive a Snapshot score in about three weeks, quarterly updates and monthly calls, and stay enrolled until you reach the minimum status the policy sets for the contract.

Systems and assets vital to society's safe operation. The policy gives physical examples such as roads, power plants, water treatment plants, hospitals and banks, and virtual ones such as the internet and essential government services. If your cloud offering supports or could affect them, the critical infrastructure matrix requires Authorized at the Moderate Impact level.

GovRAMP requires monthly continuous monitoring once a product reaches Core, Ready, Provisionally Authorized or Authorized: status checks, vulnerability tracking and closure, and alignment with NIST controls. Providers must give the state continuous monitoring access for the life of the contract, and the policy adds quarterly evidence to the agency and IOT.

It can. Based on the data processed, transferred or stored, Indiana may require the cloud products you use to deliver services to be assessed by GovRAMP or FedRAMP under NIST 800-53 Rev. 5. IOT also says any vendor that connects to state systems, even through a third party, is subject to the policy. The solicitation sets the specifics.

Indiana sets no separate state fee. You pay GovRAMP membership, the Progressing Snapshot fee if you need it, the verification fee for Core or Authorized and, for Ready and above, a 3PAO billed separately. GovRAMP tiers its fees by company revenue, which our GovRAMP cost guide breaks down.

No. Scrutineer is readiness software, not a 3PAO, the GovRAMP program office or the Indiana Office of Technology. GovRAMP verifies status and the agency approves the contract. Scrutineer holds the controls, evidence, POA&M and continuous monitoring record those bodies ask for and tracks each Indiana deadline.

Read every compliance and risk question

Keep reading

Read before you price an Indiana bid

GovRAMP certification cost and TX-RAMP pricing

The published GovRAMP fee schedule, what the 3PAO adds on top, and why Core is cheaper than it looks.

Read the guide

GovRAMP vs StateRAMP, and vs FedRAMP

What the 2025 rename changed, the full status ladder, and how reciprocity works.

Read the guide

FedRAMP 20x vs Rev 5 requirements

Why Indiana names Rev. 5 for Fast Track, and what each federal route costs in time.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification