Georgia Sets Phased GovRAMP Requirements for Cloud Procurement

Georgia will begin applying GovRAMP-aligned security and risk assessment requirements to new state procurements and contracts containing cloud services on 1 October 2026, according to the Georgia Technology Authority (GTA). Cloud services procured through the state's enterprise IT procurement process will require GovRAMP validation and GTA approval. Full compliance with Georgia's GovRAMP verification requirements becomes mandatory for procurements containing a cloud service component on 1 July 2027.

GTA also manages GovHub, a Drupal-based platform hosting more than 80 state agency websites. GTA says GovHub hosting is provided through Acquia. The arrangement illustrates how Georgia's new rules can affect cloud services around a Drupal implementation without making Drupal software itself the object of GovRAMP verification.

The required GovRAMP status is not necessarily the same for every cloud service. GTA says requirements can vary according to policy, risk, data, procurement method, contract and use case, while agencies remain responsible for applicable state and federal security, procurement and data-handling requirements. Existing contracts containing cloud services will come into alignment upon renewal, extension, major modification or new solicitation once the full requirements take effect on 1 July 2027.

GovRAMP provides a standardised, risk-based framework for assessing and continuously monitoring cloud services used by government organisations. Georgia says its approach is consistent with National Institute of Standards and Technology Special Publication 800-53 Revision 5 security controls. The state's stated objectives include reducing repetitive assessments, improving visibility into cloud-product security and extending oversight through continuous monitoring.

GovRAMP's guidance distinguishes between cloud service layers when determining security status. A software-as-a-service or platform-as-a-service offering does not automatically become GovRAMP authorised because it runs on authorised infrastructure; infrastructure, platform and software service layers must be evaluated for their own security authorisation, although applicable controls can be inherited. A Drupal application therefore should not be described as GovRAMP authorised solely because its hosting infrastructure has an assessed status.

The federal record provides additional context for GovHub's named hosting provider. The FedRAMP Marketplace currently lists Acquia Cloud as FedRAMP Certified under Revision 5 with an Agency path and Class C (Moderate) certification profile. GovRAMP's Fast Track process allows offerings with a federal authorisation, or those pursuing one, to reuse authenticated federal security documentation during GovRAMP review, but eligibility for that process does not itself establish a GovRAMP verification status.

Georgia's involvement with GovRAMP predates the new statewide requirements. GovRAMP's participating government directory lists the State of Georgia as participating since 2021, while noting that participation can represent exploration, planning or active implementation. The new procurement timetable therefore establishes a more specific statewide requirement than participation in the programme alone.

For Drupal teams serving Georgia government agencies, the practical issue is the cloud-service boundary rather than the CMS licence. Open-source Drupal does not remove security-assessment requirements that may apply to managed hosting, platforms or other qualifying cloud services used around an implementation. Suppliers will need to identify which parts of their delivery stack fall within Georgia's cloud-service requirements and which GovRAMP verification status applies to the procurement.