GovRAMP Adoption
As part of our ongoing commitment to safeguard government data and reducing cyber risks, the State of North Carolina has partnered with GovRAMP to ensure that all cloud services used by executive branch agencies meet rigorous standards for confidentiality, integrity and availability of state data.
GovRAMP is a nonprofit program that provides a unified security framework for government cloud adoption, based on National Institute of Technology and Standards (NIST) 800-53 (Rev 5).
By leveraging GovRAMP’s standardized approach to authorization and continuous monitoring, North Carolina aims to streamline procurement, reduce duplicative security assessments and mitigate cyber risks.
New Cloud Product Requirements
Effective April 1, 2026
- All new contracts containing a cloud component will include risk assessment requirements that align with the GovRAMP program, which is based on National Institute of Technology and Standards (NIST) 800-53 (Rev 5).
- The N.C. Department of Information Technology will provide an “on-ramp” period to allow vendors time to achieve the required status under the contract. Exact details on the requirements for each contract will be outlined in the purchasing mechanism or associated contract.
Effective April 1, 2027
- Full compliance will be mandatory without exception for all contracts containing a cloud component without an “on-ramp.”
- Existing contracts will need to align with GovRAMP standards upon renewal or new solicitation.
Understanding GovRAMP: Upcoming Vendor Webinars
Join the N.C. Department of Information Technology and GovRAMP for upcoming webinars on the essentials of GovRAMP – what it is, why it matters and how it can strengthen your team's security operations.
These sessions will provide a clear understanding of the GovRAMP process and how it streamlines security reviews, reduces complexity and accelerates compliance. Learn about the GovRAMP model and get guidance to support your work with the State of North Carolina.
Previous Sessions
- Feb. 26, 2026 - Slide Deck | Recording
- March 16, 2026 - Slide Deck | Recording
Vendor Resources
GovRAMP Resources
- State of North Carolina & GovRAMP: Full policy details and additional resources
- Templates & Guidance: Resources for validation and compliance
NCDIT Resources
- Bidding Opportunities: Explore current solicitations for the State of North Carolina
- Vendor Engagement Resources: Information and helpful links related to how to do business with the state
- Statewide Information Security Manual & Policies: Baseline standards for state agencies managing information security and making risk-based decisions
- Statewide Data Classification & Handling Policy: Establishes a framework to ensure consistent identification, protection and handling of state data