Scrutineer · By framework

Utah GovRAMP compliance for state cloud contracts

Utah has required cloud vendors to be GovRAMP or FedRAMP Rev. 5 engaged since July 1, 2025. That was a two-year on-ramp. For solicitations from July 1, 2027, the product must already hold a verified status of Core, Ready or Authorized.

Scrutineer keeps your NIST 800-53 controls and evidence in one place, tracks the quarterly or monthly continuous monitoring package Utah can ask to see, and shows which gaps stand between your product and the status your data type requires.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with UT GovRAMP

Two data types, two targets

Utah sets the status by what your product touches. Products that process, store or transmit non-regulated data need GovRAMP Core. Products that handle regulated data need Authorized. Core is validated by the GovRAMP program office and needs no 3PAO. Authorized needs a full 3PAO assessment, a complete security package and sponsor approval, so the regulated-data path takes the longest and should start first.

Engaged today, held by July 1, 2027

The July 1, 2025 rule asks that a proposed product be GovRAMP or FedRAMP Rev. 5 engaged. Utah chose a two-year transition, and from July 1, 2027 any solicitation that requires GovRAMP or FedRAMP expects an already verified status. Being enrolled will stop being enough for new Utah awards. The guide also says the state can instruct otherwise, so each solicitation controls.

Monitoring continues for the life of the contract

Core products submit continuous monitoring quarterly. Ready and Authorized products submit monthly. Each package carries an updated POA&M, the inventory workbook, operating system, database and web application scans, deviation requests and an executive summary. Utah requires access to those artifacts throughout the contract, so the evidence has to stay current, not just pass once.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Holds one NIST SP 800-53 Rev. 5 control library, the basis for GovRAMP Core and Authorized, so the July 2027 deadline becomes a gap list rather than a new program
Separates your Utah contracts by data type, so you know which products need Core and which need Authorized
Tracks the status deadline per solicitation, because Utah can set different terms in a specific bid
Keeps the POA&M and the asset inventory current, the two documents every monitoring submission starts from
Stores vulnerability scan results and deviation requests next to the control they relate to, ready for the quarterly or monthly package
Shows which SOC 2 and ISO 27001 evidence already answers Rev. 5 controls, and which controls still have nothing behind them
Records the GovRAMP membership renewal date, which falls on June 1 each year
Reuses the same evidence for Arizona, North Carolina, Georgia, Indiana, Texas, FedRAMP and SOC 2

UT GovRAMP readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Utah requirement reference

What Utah expects, by data type and date

Most GovRAMP guides list the status ladder. Utah ties the target to the data you handle and moves the bar from engaged to held on one date. This table runs on the GovRAMP State of Utah program page, the Utah vendor requirements guide and the Utah requirements packet.

What your product handles	Status Utah expects	Timing	What you submit
Non-regulated data only	GovRAMP Core	Engaged now, held for solicitations from July 1, 2027	Quarterly: POA&M, inventory workbook, scans, deviation requests, summary
Regulated data	GovRAMP Authorized	Engaged now, held for solicitations from July 1, 2027	Monthly: the same package, after a full 3PAO assessment
FedRAMP Rev. 5 authorized or in progress	Accepted as engaged	The same July 1, 2027 date applies to GovRAMP or FedRAMP	Whatever the solicitation sets
Progressing Snapshot enrollment only	Not a held status	Quarterly Snapshot, 40 high-impact controls	Move to Core or Authorized before July 2027
A SOC 2 or ISO 27001 report alone	Not a GovRAMP status	Utah says it assesses against NIST 800-53	The GovRAMP path above
A product that runs on someone else's cloud	Possibly, by data type	Set in the solicitation	Evidence of the underlying product's status

Reflects the GovRAMP State of Utah program page, the Utah vendor requirements guide and the Utah requirements packet as read in November 2026. The packet gives a typical timeline of 12 to 18 months while the vendor guide says Authorized is achieved within 18 to 24 months of enrollment, so plan on the longer range. Each solicitation sets the exact terms, so confirm yours with dts-compliance@utah.gov. Scrutineer prepares readiness evidence and does not award any status.

Good questions

Questions about UT GovRAMP

Yes, for cloud service providers and resellers doing business with Utah executive branch agencies. The requirement took effect on July 1, 2025 and asks that the proposed product be GovRAMP or FedRAMP Rev. 5 engaged unless Utah instructs otherwise. Utah will require a verified status for solicitations from July 1, 2027.

July 1, 2027. Utah offered a two-year transition from July 1, 2025. After that date, every solicitation that requires GovRAMP or FedRAMP expects the product to already hold a verified GovRAMP status of Core, Ready or Authorized, or Provisionally Authorized, not just be enrolled.

It depends on the data. Products that process, store or transmit non-regulated data need GovRAMP Core. Products that process, store or transmit regulated data need GovRAMP Authorized. Utah can set different terms in a specific solicitation, so read the bid documents for the exact level.

Yes, FedRAMP Rev. 5. Utah states that the proposed product must be GovRAMP or FedRAMP Rev. 5 engaged. The program guide does not list FedRAMP 20x as an accepted route, so check the solicitation before you rely on a 20x authorization.

No. Utah says it keeps the NIST 800-53 standard and relies on GovRAMP continuous monitoring under the NIST framework. A SOC 2 or ISO 27001 report is not a GovRAMP status. Most of that evidence still maps to NIST controls, which shortens the work of building the Core or Authorized package.

Core products submit quarterly. Ready and Authorized products submit monthly. A package includes the updated POA&M, inventory workbook, operating system, database and web application scans, deviation request forms and an executive summary. Utah must be given access to this material for the life of the contract and can request the security package.

The Utah vendor guide says Authorized or Provisionally Authorized is achieved within 18 to 24 months from enrollment. The Utah requirements packet says up to 12 to 18 months total. Because the two Utah documents differ, assume the longer range, which means a regulated-data vendor that has not started is already close to the July 2027 date.

Utah sets no separate state fee. GovRAMP publishes 2026 fees on a revenue scale. Core is $9,000, $11,000 or $17,000 a year by revenue band, plus quarterly monitoring of $250, $500 or $1,000. A 3PAO for Authorized is billed separately and GovRAMP does not publish a range for it. Our GovRAMP cost guide breaks down the rest.

A quarterly assessment of the 40 most impactful NIST aligned controls from the Ready control set, with a monthly advisory call from the GovRAMP program office. In the 2026 packet it costs $750, $1,000 or $1,600 a month by revenue band. It supports engaged status and builds toward Core, Ready or Authorized.

No. Scrutineer is readiness software, not a third party assessment organization, the GovRAMP program office or the State of Utah. GovRAMP verifies status and the state approves the contract. Scrutineer holds the controls, POA&M, inventory and monitoring evidence those bodies ask for and tracks each Utah deadline on one timeline.

Read every compliance and risk question

Keep reading

Read before you price a Utah bid

GovRAMP certification cost and TX-RAMP pricing

The published GovRAMP fee schedule, what the 3PAO adds on top, and why Core is cheaper than it looks.

Read the guide

GovRAMP vs StateRAMP, and vs FedRAMP

What the 2025 rename changed, the full status ladder, and how reciprocity works.

Read the guide

FedRAMP 20x vs Rev 5 requirements

Why Utah names Rev. 5, and what each federal route costs in time.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification