North Carolina's new cloud contracting rule took effect April 1, 2026. Indiana's version has been running since October 2025. Nevada's followed in July 2026. Each state borrowed the same underlying idea: require vendors to prove their security posture through GovRAMP, the shared authorization framework built so a cloud provider doesn't repeat the same security review in every state capital.
The idea was one proof, reused everywhere. What's actually happening is three different timelines, three different thresholds, and in Texas, an entirely separate program that won't take a GovRAMP authorization at face value.
One Baseline, Several Versions
Texas runs its own system, the Texas Risk and Authorization Management Program, known as TX-RAMP. A vendor holding a current GovRAMP or FedRAMP authorization doesn't get an automatic pass there. Texas requires a separate reciprocity request, and the state validates the outside authorization before granting its own certification. That's a second review layered on top of the first, for a product that already cleared an equivalent bar somewhere else.
North Carolina's mandate phases in through April 1, 2027, when full compliance becomes required for covered contracts with no grace period left. Existing contracts fall under the rule whenever they're renewed or re-solicited, so a vendor that signed a deal in 2024 could face new GovRAMP-alignment requirements at renewal, not at the original bid. Indiana and Nevada each run their own version of the same basic idea, with their own effective dates and their own documentation expectations.
Georgia took a different path this month, adopting GovRAMP as its statewide framework for cloud service security rather than writing a separate state-specific standard. That's the outcome the reciprocity conversation is supposed to produce. It also makes Georgia the exception right now, not the rule. Most states are still choosing to build their own version instead of pointing to the one that already exists.
A GovRAMP authorization should answer the security question once. When every state treats it as the starting point for a separate review, compliance teams end up managing the exact problem GovRAMP was supposed to solve.
What This Means for Procurement and Compliance Teams
If you're issuing or renewing a cloud services RFP, the reciprocity question needs to show up earlier than it usually does. A vendor that's never had to answer it before your solicitation lands will end up answering it during your procurement timeline instead, and that's a worse place for everyone to find out.
Ask before you sign, not after
Does the vendor's current authorization transfer to your state, or does it trigger a separate review? How long does that review typically take, and what covers the gap while it's pending? Has the vendor been through this with another state recently, and what did that state actually require beyond the GovRAMP baseline? The answers tell you more about a vendor's operational maturity than the authorization certificate itself.
Route Fifty's reporting on the issue lays out what a better version looks like: presumptive reciprocity for equivalent authorizations, a public crosswalk showing how GovRAMP, FedRAMP, and state-specific statuses line up, and overlays that stay narrow and tied to an actual identified risk, like criminal justice data or tax records, instead of general preference. None of the states in that reporting have fully implemented all three yet. Most agencies are still working from whatever documentation a vendor happens to send over, which puts the burden of explaining the gap on the wrong side of the table.
Where cloudPWR Stands on This
cloudPWR has carried GovRAMP membership alongside SOC 2 Type II certification since before either was a procurement requirement in most states, so the reciprocity question isn't new territory for us. AIRLIFT Connect, the integration layer that moves documents and data through the broader AIRLIFT platform, runs on Microsoft Azure's government-oriented infrastructure specifically so an agency's compliance posture doesn't depend on where a server physically sits.
That doesn't make every state's additional paperwork disappear. Texas is still going to ask Texas questions. But it does mean an agency evaluating AIRLIFT Connect for a cloud-adjacent workflow, whether that's e-signature capture, Box delivery, or a statewide patient registry, starts from an authorization record that's already been through independent validation instead of starting from zero.
The fragmentation described above isn't going away on its own. States are building these mandates one legislative session at a time, and reciprocity only gets fixed if procurement offices start asking for it explicitly. Until then, the smartest move for an agency evaluating a cloud vendor is the same one it's always been: ask what's actually been verified, by whom, and whether that verification travels. If you're sorting through a GovRAMP or FedRAMP authorization record for an upcoming RFP and want a second set of eyes on what it actually covers, cloudPWR's team can walk through it with you.