Scrutineer · By framework

Minnesota GovRAMP compliance for MNIT cloud vendors

Minnesota now writes GovRAMP into every state contract with a cloud vendor that handles high-categorized data. The language has applied to new contracts since October 1, 2025, it is added to existing ones at amendment or renewal, and by April 1, 2027 every in-scope vendor must be GovRAMP Authorized.

Scrutineer holds your NIST 800-53 controls and evidence once, keeps the System Security Plan MNIT reviews current, and tracks the Snapshot score, progress reports and deadline for each Minnesota contract.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with MN GovRAMP

Only high data is in scope, and then the bar is Authorized

Minnesota requires a GovRAMP assessment only for cloud products that process, transmit or store high-categorized data, directly or through a third party. High data under the MNIT Data Protection Categorization Standard includes PHI, SSA data, CJI, government ID numbers such as SSNs and driver's license numbers, FTI, PCI account data and bank account numbers. If you are in scope, there is no Core or Ready tier to settle for. The target is GovRAMP Authorized at the moderate impact level.

A Snapshot letter within 60 days, then proof of progress to 100%

If your product holds no GovRAMP status when the contract is signed, you owe MNIT a GovRAMP Snapshot score letter within 60 days of execution. A score under 100% puts the product in the Progressing Snapshot program until it reaches 100%, and you must give the state every progress report and updated score along the way. GovRAMP issues those updated Snapshots quarterly. Core, Ready or low impact Authorized can stand in for the Snapshot, but MNIT keeps continuous monitoring access until you reach moderate Authorized.

SOC 2 and ISO 27001 are named as not accepted

Minnesota accepts GovRAMP or FedRAMP Rev. 5 and nothing else. TX-RAMP, SOC 2, ISO 27001 and HITRUST are listed by name as not accepted, along with self-attestations, trust documents and SOC 3 reports. MNIT asks for your System Security Plan or Written Information Security Program for its own evaluation. A FedRAMP Rev. 5 product does not need a new 3PAO, but it must enroll in GovRAMP Fast Track so Minnesota gets continuous monitoring.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Holds one NIST SP 800-53 Rev. 5 control library at the moderate baseline, the level Minnesota requires, so the April 2027 deadline becomes a gap list rather than a new program
Flags which of your Minnesota contracts touch high-categorized data, the only trigger for the GovRAMP requirement, so you do not over-scope low data work
Tracks the 60 day Snapshot letter deadline from each contract execution date and the April 1, 2027 Authorized deadline on one timeline
Stores every Progressing Snapshot report and updated score, ready to hand to MNIT, because the contract gives the state access to all of them
Keeps the System Security Plan or WISP current, the document Minnesota asks for instead of a SOC 2 report
Shows which SOC 2, ISO 27001 and HITRUST evidence already answers moderate baseline controls, and which controls still have nothing behind them
Lists the cloud services under your professional services offering that touch high data, because Minnesota requires those to be GovRAMP or FedRAMP assessed too
Reuses the same evidence for North Carolina, Georgia, Arizona, Texas, FedRAMP and SOC 2, because each tests NIST 800-53 controls you already hold

MN GovRAMP readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Minnesota requirement reference

What Minnesota accepts, and what it does not

Most GovRAMP guides list the status ladder. Minnesota skips most of it, sets one target for high data and names the reports it will not take. This table runs on the GovRAMP Minnesota program page and the MNIT briefing of October 2025.

What your product has today	Does Minnesota accept it	What you owe the state	Deadline
No GovRAMP status, high data in the contract	Not on its own	A GovRAMP Snapshot score letter, then Progressing Snapshot enrollment if the score is under 100%	Letter within 60 days of contract execution, Authorized by April 1, 2027
GovRAMP Core, Ready or Authorized at low impact	Yes, in place of the Progressing Snapshot	Continuous monitoring access for MNIT until moderate Authorized	Authorized at moderate by April 1, 2027
GovRAMP Authorized at moderate impact	Yes, this is the target	Continuous monitoring access for MNIT	Already met
FedRAMP Rev. 5 authorization or one in progress	Yes, through GovRAMP Fast Track	GovRAMP membership and the same security package, no new 3PAO	Enroll before the state relies on it
TX-RAMP certification	No	A GovRAMP status, GovRAMP reciprocity with TX-RAMP does not create one	April 1, 2027
A SOC 2, ISO 27001 or HITRUST report	No, named as not accepted	Your SSP or WISP for MNIT review, plus the GovRAMP path above	April 1, 2027
Only low or moderate data in the contract	No GovRAMP assessment required today	Whatever the solicitation sets	Recheck if the data changes
A services contract that runs on someone else's cloud with high data	Only if that cloud is GovRAMP or FedRAMP assessed	Evidence of the underlying product's status	Set in the solicitation

Reflects the GovRAMP State of Minnesota program page and the Minnesota IT Services briefing to the Legislative Commission on Cybersecurity dated October 27, 2025, as read in October 2026. Each solicitation sets the exact terms, so confirm yours with the purchasing agency or MNIT Vendor Security and Risk Management. Scrutineer prepares readiness evidence and does not award any status.

Good questions

Questions about MN GovRAMP

Yes, for cloud and hosted service vendors that handle high-categorized state data. Since October 1, 2025, new state contracts with those vendors include GovRAMP requirements, and existing contracts get the language at amendment or renewal. By April 1, 2027, every in-scope vendor, new or existing, must be GovRAMP Authorized.

GovRAMP Authorized at the moderate impact level, for products that process, transmit or store high risk data. Minnesota does not set Core or Ready as a final target. Core, Ready or low impact Authorized are accepted only in place of the Progressing Snapshot while you work toward moderate Authorized.

April 1, 2027. MNIT told the Legislative Commission on Cybersecurity that all cloud vendors handling high-categorized data, both new and existing, must be GovRAMP Authorized by then, and described the 18 months from October 2025 as the time to understand the contract terms and finish authorization.

Data that is highly sensitive or protected by law, as defined in the MNIT Data Protection Categorization Standard. It includes PHI under HIPAA, Social Security Administration data, criminal justice information, government ID numbers such as SSNs and driver's license numbers, federal tax information, PCI account data and bank account numbers other than state-owned accounts.

You submit a GovRAMP Snapshot score letter no later than 60 days after contract execution. If the score is below 100%, the product joins the Progressing Snapshot program and stays there until it reaches 100%, while still moving toward Authorized by April 1, 2027. Minnesota gets access to every progress report and updated score.

No. Minnesota names TX-RAMP, SOC 2, ISO 27001 and HITRUST as not accepted, and also rules out self-attestations, trust documents and SOC 3 reports, citing NIST as the framework it must assess against. It asks for your System Security Plan or Written Information Security Program instead. Your SOC 2 evidence still helps, because most of it maps to NIST 800-53.

Yes, FedRAMP Rev. 5. A product that holds or is seeking a FedRAMP Rev. 5 status must enroll in the GovRAMP Fast Track program, which means GovRAMP membership and submitting the same security package to the GovRAMP program office. No new 3PAO assessment is needed, and Minnesota gets the continuous monitoring it requires.

No. GovRAMP offers reciprocity with TX-RAMP, but Minnesota says TX-RAMP compliance does not give you a GovRAMP security status, and lists TX-RAMP among the frameworks it will not accept. A Texas certified product still needs its own GovRAMP path to sell high data services to Minnesota.

Yes, when high-risk data passes through it. If high data is processed, transferred or stored within your professional services offering, Minnesota requires the cloud solutions you use to deliver those services to be assessed by GovRAMP or FedRAMP. The specific terms sit in each solicitation.

Minnesota sets no separate state fee. You pay GovRAMP membership, the Progressing Snapshot fee if you need it, the program fee for Authorized and a third party assessment organization billed separately. GovRAMP tiers its fees by company revenue and offers a 3PAO discount after Snapshot or Core, which our GovRAMP cost guide breaks down.

No. Scrutineer is readiness software, not a third party assessment organization, the GovRAMP program office or MNIT. GovRAMP verifies status and the state approves the contract. Scrutineer holds the controls, SSP, POA&M and evidence those bodies ask for and tracks every Minnesota deadline on one timeline.

Read every compliance and risk question

Keep reading

Read before you price a Minnesota bid

GovRAMP certification cost and TX-RAMP pricing

The published GovRAMP fee schedule, what the 3PAO adds on top, and why Core is cheaper than it looks.

Read the guide

GovRAMP vs StateRAMP, and vs FedRAMP

What the 2025 rename changed, the full status ladder, and how reciprocity works.

Read the guide

FedRAMP 20x vs Rev 5 requirements

Why Minnesota names Rev. 5, and what each federal route costs in time.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification