Scrutineer.ai
How it works
SOC 2 compliance SOC 2 software ISO 27001 HIPAA Vendor risk Third-party risk Security assessment Questionnaire automation GRC software Continuous compliance SOX compliance Security compliance Cyber risk assessment CMMC FedRAMP See all →
Vanta alternative Drata alternative AuditBoard alternative SecurityScorecard alternative UpGuard alternative Secureframe alternative Sprinto alternative Hyperproof alternative OneTrust alternative Thoropass alternative RiskRecon alternative Bitsight alternative CyberGRX alternative Whistic alternative Panorays alternative
Pricing Blog Sign in

Scrutineer · By framework

North Carolina GovRAMP compliance for NCDIT vendors

North Carolina now buys cloud services on GovRAMP status. New executive branch contracts have carried GovRAMP requirements since April 1, 2026, and from April 1, 2027 there is no on-ramp at all.

Scrutineer holds your NIST 800-53 controls and evidence once, shows which GovRAMP status your data class demands, and tracks each contract's window on one timeline.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with NC GovRAMP

Your data classification picks the status, and the deadline

North Carolina does not set one GovRAMP level for everyone. The NCDIT policy supplement, Third-Party Cloud Service Risk Authorization and Management, version 1.0 of February 2026, ties the required status to the highest class of state data your product will hold. Public data needs only a GovRAMP Security Snapshot Score, validated before award and reviewed every year. Internal data needs GovRAMP Core, either at award or within 12 months. Confidential data, such as personnel or student records, needs GovRAMP Ready within 15 months. Restricted data, such as federal tax information, payment card data, PHI or criminal justice information, needs GovRAMP Authorized within 21 months. Those windows are shorter than the ones Arizona publishes, so do not copy another state's plan.

FedRAMP Rev. 5 counts. FedRAMP 20x does not

A FedRAMP Rev. 5 authorization held at the time of award is accepted in place of GovRAMP. The same sentence of the policy then says that authorizations obtained through the FedRAMP 20x pilot program will not be permitted. That matters to the growing number of SaaS companies who chose 20x as the faster federal route. A 20x authorization that works for a federal agency does not satisfy a North Carolina contract, and the state may separately ask a FedRAMP holder to enroll in GovRAMP Fast Track so it can read continuous monitoring through the GovRAMP portal. Check which FedRAMP path you are on before you assume the federal work carries over.

April 1, 2027 is the date with no on-ramp

Since April 1, 2026, new North Carolina contracts with a cloud component carry GovRAMP-aligned requirements, with an on-ramp period set contract by contract. From April 1, 2027, NCDIT says full compliance is mandatory without exception and without an on-ramp. Existing contracts pick up GovRAMP language when they are renewed, extended or amended, and NCDIT's June 2026 guidance only lets a short bridge extension, typically under a year, lean on an existing certification. If the interim window runs out, an agency may grant one extension of no more than six months, and only after its security liaison reviews your latest Progressing Snapshot.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

  • Holds one NIST SP 800-53 Rev. 5 control library and maps it to GovRAMP Core, Ready and Authorized, so the North Carolina requirement is a gap list rather than a new program
  • Records the data classification each contract allows, Public, Internal, Confidential or Restricted, and shows the GovRAMP status and interim window that class triggers
  • Tracks the 12, 15 and 21 month windows from each contract effective date, plus the single six month extension an agency may grant
  • Keeps a live POA&M, inventory workbook and vulnerability scan record, the documents GovRAMP standard continuous monitoring access collects every month or quarter
  • Keeps the System Security Plan current for agencies that request elevated monitoring access to your SSP, SAP and SAR
  • Shows which SOC 2, ISO 27001, HITRUST and TX-RAMP evidence already answers GovRAMP controls, and which controls have nothing behind them yet
  • Flags the cloud services your own professional services run on, since North Carolina checks those too when they hold sensitive state data
  • Reuses the same evidence for Arizona, Texas, FedRAMP and SOC 2, because every one of those programs tests NIST 800-53 controls you already hold
NC GovRAMP readiness_report
Readiness 82%
ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

North Carolina policy reference

What North Carolina requires for each class of state data

Most GovRAMP guides describe the status ladder in general. North Carolina wrote its own rule on top of it: the data class decides the status and the clock, FedRAMP Rev. 5 is accepted, and FedRAMP 20x is not. This table runs on the NCDIT policy supplement itself.

What the service holds or has What North Carolina requires By when What you file meanwhile
Public data only (formerly low risk) A GovRAMP Security Snapshot Score Before contract award An updated score every year, reviewed by the agency
Internal data (formerly part of medium risk) GovRAMP Core At award, or within 12 months Progressing Snapshot enrollment before any non-public data moves
Confidential data (formerly part of medium risk) GovRAMP Ready At award, or within 15 months Progressing Snapshots validated by the agency every quarter
Restricted data (formerly high risk) GovRAMP Authorized At award, or within 21 months Progressing Snapshots validated every quarter
A FedRAMP Rev. 5 authorization Accepted in place of GovRAMP Must be held at award Annual check that it is in good standing, and Fast Track if the agency asks
A FedRAMP 20x authorization Not permitted Not applicable A GovRAMP status sized to the data class above
A SOC 2, ISO 27001 or HITRUST report alone Not named as a substitute The status for your data class still applies Map the evidence to NIST 800-53 and file the GovRAMP package
A short bridge extension, under about a year Existing certification may be relied on Only during a vendor transition or active solicitation GovRAMP language at the next renewal or amendment

Reflects the NCDIT Third-Party Cloud Service Risk Authorization and Management supplement, version 1.0, February 2026, the NCDIT GovRAMP adoption page and its June 2026 guidance on existing contracts, as read in October 2026. Each solicitation sets the exact terms, so confirm yours with the purchasing agency or ESRMO. Scrutineer prepares readiness evidence and does not award any status.

Good questions

Questions about NC GovRAMP

Yes, for cloud services used by executive branch agencies. Since April 1, 2026, new contracts with a cloud component include GovRAMP-aligned risk assessment requirements and an on-ramp period. From April 1, 2027, NCDIT says full compliance is mandatory without exception, and existing contracts adopt GovRAMP terms when they are renewed, extended or amended.
It depends on the highest class of state data in the service. Public data needs a GovRAMP Security Snapshot Score. Internal data needs GovRAMP Core, Confidential data needs GovRAMP Ready and Restricted data needs GovRAMP Authorized. The agency picks the class, and NCDIT validates it for purchases made through Statewide IT Procurement.
The interim windows run from the contract effective date: 12 months for Core, 15 months for Ready and 21 months for Authorized. An agency may grant one extension of up to six months if its security liaison has reviewed your latest Progressing Snapshot and confirmed mitigations are in place.
Yes, if it is a FedRAMP Rev. 5 authorization held at contract award. Authorizations obtained through the FedRAMP 20x pilot are not permitted. The agency checks at least once a year that the authorization is in good standing, and may require you to enroll in GovRAMP Fast Track for continuous monitoring.
Not as a substitute. The NCDIT policy names GovRAMP status, or a FedRAMP Rev. 5 authorization, for each data class and does not list SOC 2, ISO 27001 or HITRUST as alternatives. The one exception is a short bridge extension, where an agency may rely on an existing certification while a contract transitions.
It is the interim period that lets a vendor win a contract before holding the required status. Before award the agency reviews your Security Snapshot Score. After award you must be enrolled in the GovRAMP Progressing Snapshot program before any non-public state data is transferred, stored or processed, and Confidential or Restricted services are checked every quarter.
Yes, at renewal, extension or amendment. NCDIT guidance from June 2026 says GovRAMP terms are added at those points, with updated language in the Ariba Sourcing Tool and PCORE. A short bridge extension of typically less than a year may keep relying on the existing certification. Contracts hosted on state infrastructure need no change.
You upload monthly or quarterly packages to the GovRAMP portal: POA&Ms, an updated inventory workbook, OS, database and web application vulnerability scans, deviation requests and an executive summary. Agencies can request elevated access to your SSP, SAP and SAR, and you should approve access within 14 days of contract award.
It can. If your professional services store or process sensitive state data in a cloud service, the agency validates that the service meets the same protection level before award, which may mean confirming its GovRAMP or FedRAMP authorization. Check the solicitation, because the requirement follows the data, not the contract type.
North Carolina charges no separate fee. The cost is GovRAMP membership, the program fee for the status you need and, for Ready or Authorized, a third party assessment organization billed separately. GovRAMP tiers its fees by company revenue, and NCDIT hosted a vendor webinar on program costs in September 2026.
No. Scrutineer is readiness software, not a third party assessment organization, the GovRAMP program management office or NCDIT. GovRAMP verifies status and the agency approves the service. Scrutineer holds the controls, SSP, POA&M and evidence those bodies ask for and tracks every North Carolina contract window on one timeline.
Read every compliance and risk question

Keep reading

Guides that go deeper on this framework

GovRAMP certification cost and TX-RAMP pricing

The published GovRAMP fee schedule, what the 3PAO adds on top, and why Core is cheaper than it looks.

Read the guide

FedRAMP 20x vs Rev 5 requirements

Why the federal route you pick decides whether North Carolina will accept it.

Read the guide

GovRAMP vs StateRAMP, and vs FedRAMP

What the 2025 rename changed, the full status ladder, and how reciprocity works.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more
See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification