Which States Use GovRAMP? The Complete 2026 List of 33 States

Which states use GovRAMP is the question providers ask when a solicitation names the programme, and the honest answer has two parts. GovRAMP’s own participating-organisations list, read on 19 September 2026, shows 72 government organisations across 33 states — 30 of them with a state-level participant, from Georgia’s 2021 adoption to Idaho’s and Illinois’s in 2026, plus counties, cities, school districts, universities, one tribal government and one federal agency.

But GovRAMP itself notes that participation “can reflect exploration, planning, or active implementation”, and adoption ranges from accepting Core for low-risk tools to writing GovRAMP into procurement policy. Texas sits outside the list’s logic entirely: its law requires TX-RAMP, which recognises GovRAMP with automatic reciprocity. This guide sets out the states with state-level participants and their join years, the states where only local or education bodies participate, what “adopt” means on GovRAMP’s own adoption roadmap, how to read a solicitation, and the three mistakes providers make about state requirements.

Which states use GovRAMP at state level

Asked which states use GovRAMP below state level, three further states appear only through local or education participants: Colorado (Glenwood Springs, Fountain, Greeley-Evans School District 6 and one more local body), Florida (Hillsborough County Sheriff’s Office, Palm Beach Gardens, Lake County) and Virginia (Richard Bland College and, unusually, the US Coast Guard as a federal participant). Some state-level entries are a single branch or office rather than the executive — Nebraska’s and Idaho’s courts, Illinois’s Comptroller, New Jersey’s cybersecurity cell — which matters for what the entry implies. Texas has the most participants at eight. Georgia was first, in 2021, and GovRAMP’s news page reports its adoption as a milestone.

What “adopt” means on GovRAMP’s roadmap

GovRAMP’s guidance for governments describes three adoption approaches, and they explain why a state on the list may still not require anything. The first is an adoption roadmap: inventory systems by impact level, engage procurement, IT and legal, and “define milestones for recognizing, preferring, or requiring GovRAMP verification” — the example given is a state agency accepting GovRAMP Core immediately for low-risk tools while developing a plan for more.

The second is to require GovRAMP in procurement. The third is alternative approaches that integrate the framework without a mandate. The programme also supplies sample procurement language and templates through its Government Engagement Team. In other words, “which states use GovRAMP” spans recognise, prefer and require, and only the solicitation tells you which applies to the contract in front of you. Our guide to GovRAMP status levels covers the statuses a solicitation can name.

Texas: the state that requires something else

Any answer to which states use GovRAMP has a Texas footnote. Texas passed a law in 2021 requiring vendors using cloud to serve Texas state agencies, higher-education institutions and community colleges to hold TX-RAMP certification, run by the Department of Information Resources. TX-RAMP recognises GovRAMP with automatic reciprocity by administrative rule, and GovRAMP syncs its Authorized products to the TX-RAMP list weekly — so a GovRAMP Authorized product is a Texas-compliant product, but a Texas contract still turns on TX-RAMP status, not GovRAMP membership. Our guide to TX-RAMP covers the two levels and the provisional route.

Which states use GovRAMP is decided by the solicitation

1. Find the programme name. “GovRAMP”, “StateRAMP” (the old name still appears), “TX-RAMP”, “FedRAMP” or “NIST 800-53” — each is a different requirement.
2. Find the status and the timing. Many solicitations accept a progressing status at award with a verified status — Core, Ready or Authorized — required within a set period.
3. Find the impact level. Low, Moderate or High decides the control count and the 3PAO scope.
4. Check the agency’s own programme page. GovRAMP’s participating list links to agency pages where they exist; the requiring agency’s guidance overrides the general picture.
5. Ask the Government Engagement Team if the language is ambiguous; the programme exists to standardise exactly this.

Three mistakes about state requirements

• Treating the list as a mandate map. A state on the list may recognise GovRAMP for some agencies and not others; a state off the list may still accept it. Participation “can reflect exploration, planning, or active implementation”.
• Assuming FedRAMP covers the states. It transfers through the Fast Track, but a solicitation naming GovRAMP wants a GovRAMP status; our guide to GovRAMP vs FedRAMP covers the difference.
• Selling to Texas on a GovRAMP membership. Only Authorized products sync to the TX-RAMP list; Progressing and Snapshot do not.

Frequently asked questions

Which states use GovRAMP?
As of 19 September 2026 GovRAMP lists 72 participating government organisations across 33 states, with state-level participants in 30 — including Georgia (2021), Arizona, Arkansas, Massachusetts, Michigan, North Carolina, North Dakota, Oklahoma and Texas (2022), and Alaska, Utah, Idaho and Illinois more recently — plus local, K-12, higher-education, tribal and federal participants. Participation ranges from exploration to a procurement requirement.

Does being listed mean the state requires GovRAMP?
No. GovRAMP describes adoption as recognising, preferring or requiring verification, and its example is a state accepting Core for low-risk tools while planning further steps. The solicitation decides.

Does Texas require GovRAMP?
Texas requires TX-RAMP under its 2021 law; TX-RAMP recognises GovRAMP with automatic reciprocity and GovRAMP Authorized products are synced to the TX-RAMP list weekly.

Which state adopted first?
Georgia, listed with a 2021 join year; eight states joined at state level in 2022.

Is the list growing?
Yes. Idaho’s Administrative Office of the Courts, Illinois’s Office of the Comptroller, New York City’s DCAS, Maine’s community college system and an Arizona school district all show 2026 join years.

Where this leaves you

Read which states use GovRAMP as a market map, not a rulebook: 33 states have participants and 30 have a state-level one, but each solicitation names its own programme, status, impact level and deadline. Check the requiring agency’s page, plan for Texas through TX-RAMP reciprocity, and pursue the status the contracts you are chasing actually name.

References

• GovRAMP: Participating Government Organizations — The list of 72 participating organisations with state, entity type and join year, read 19 September 2026, and the note that participation can reflect exploration, planning or implementation.
• GovRAMP: Adopt GovRAMP — The three adoption approaches — roadmap, require, alternative — and the recognise / prefer / require milestones.
• GovRAMP: Fast Track Program — The Texas note: the 2021 law, TX-RAMP’s automatic reciprocity and the weekly sync of Authorized products.

More on government cloud authorization

• Which states use GovRAMP — you are here
• StateRAMP is now GovRAMP
• GovRAMP status levels
• TX-RAMP: the two Texas levels
• GovRAMP vs FedRAMP
• GovRAMP cost

The Pursuit Strategy, the Reciprocity Mapping, the State Sponsor Engagement Pack and the Customer Implementation Guide are in the GovRAMP (StateRAMP) TX-RAMP Compliance Toolkit, or start with the free templates.