/state-specific

description: State-by-state variations in StateRAMP requirements

StateRAMP State-Specific Requirements

Provides guidance on state-by-state variations, additional requirements, and acceptance criteria for StateRAMP authorizations.

Arguments

• `$1` - State code (optional: CA, TX, FL, NY, IL, etc. or "all")

StateRAMP Participating States

**Current Participants** (15+ states as of 2024):

• California (CA)
• Texas (TX)
• Florida (FL)
• New York (NY)
• Illinois (IL)
• Michigan (MI)
• Pennsylvania (PA)
• Ohio (OH)
• Georgia (GA)
• North Carolina (NC)
• Colorado (CO)
• Arizona (AZ)
• Maryland (MD)
• Massachusetts (MA)
• Washington (WA)

**Growing**: New states join regularly, check StateRAMP website for current list

StateRAMP Impact Council

**Purpose**: Coordinate multi-state reciprocity and authorization acceptance

**Functions**:

• Review and approve StateRAMP authorizations
• Maintain baseline requirements
• Coordinate state participation
• Facilitate reciprocity agreements

**Reciprocity Model**:

• One StateRAMP authorization accepted by multiple states
• Individual states may add supplemental requirements
• Reduces redundant assessments and costs

Core vs. State-Specific Requirements

Core StateRAMP Requirements (All States)

**Universal Across States**:

• NIST 800-53 control baselines (Low/Moderate)
• Third-party assessment (3PAO)
• Continuous monitoring
• Required documentation (SSP, SAP, SAR, POA&M)
• Annual assessments
• Significant change notifications (30 days)

State-Specific Variations

**Common Areas of Variation**:

1. **Additional Controls**: Some states require controls beyond baseline 2. **Data Residency**: Where data can be stored/processed 3. **Privacy Requirements**: State privacy laws 4. **Breach Notification**: State-specific timelines 5. **Records Retention**: State records laws 6. **Legal/Regulatory**: State-specific compliance 7. **Acceptance Process**: Review and approval procedures

State-by-State Details

California (CA)

**Additional Requirements**:

• **CCPA Compliance**: California Consumer Privacy Act
• **Data Residency**: May require data stored in US
• **Privacy Controls**: Enhanced privacy protections
• **Breach Notification**: 72 hours to Attorney General if >500 residents

**Participating Agencies**:

• California Department of Technology (CDT)
• Various state departments

**Key Contacts**:

• CDT StateRAMP Program Office

**Notes**:

• Large state market
• Strong privacy requirements
• May require CCPA addendum to contracts

Texas (TX)

**Additional Requirements**:

• **Data Residency**: Strong preference for Texas or US data centers
• **DIR Compliance**: Department of Information Resources standards
• **Privacy**: Texas Privacy Protection Act considerations
• **Breach Notification**: "Without unreasonable delay"

**Participating Agencies**:

• Texas Department of Information Resources (DIR)
• Multiple state agencies and higher education

**Key Contacts**:

• DIR Security Office

**Notes**:

• Second largest state market
• May require Texas-specific security controls
• Strong focus on data sovereignty

Florida (FL)

**Additional Requirements**:

• **Public Records**: Florida Sunshine Law compliance
• **Data Residency**: Prefer US-based data centers
• **Breach Notification**: 30 days to Department of Legal Affairs

**Participating Agencies**:

• Florida Digital Service
• Agency for State Technology (AST)

**Key Contacts**:

• AST Security Office

**Notes**:

• Public records law very broad
• Must accommodate public records requests
• Criminal justice information has special requirements

New York (NY)

**Additional Requirements**:

• **SHIELD Act**: Stop Hacks and Improve Electronic Data Security Act
• **Data Encryption**: Specific encryption requirements
• **Privacy**: NY Privacy Act considerations
• **Breach Notification**: "Without unreasonable delay" to Attorney General

**Participating Agencies**:

• NY Office of Information Technology Services (ITS)

**Key Contacts**:

• ITS Security Operations Center

**Notes**:

• SHIELD Act may exceed StateRAMP baseline
• Strong focus on data protection
• Financial services may require NYDFS 23 NYCRR 500 as well

Illinois (IL)

**Additional Requirements**:

• **BIPA**: Biometric Information Privacy Act (if applicable)
• **Privacy**: Personal Information Protection Act
• **Breach Notification**: Without unreasonable delay

**Participating Agencies**:

• Department of Innovation & Technology (DoIT)

**Key Contacts**:

• DoIT Security Team

**Notes**:

• BIPA is nation's strictest biometric law
• Avoid collecting biometrics if possible

Colorado (CO)

**Additional Requirements**:

• **CPA**: Colorado Privacy Act compliance
• **Data Residency**: Preference for US data centers
• **Breach Notification**: 30 days to Attorney General

**Participating Agencies**:

• Governor's Office of Information Technology (OIT)

**Key Contacts**:

• OIT Security Office

**Notes**:

• CPA similar to CCPA/GDPR
• Consumer privacy rights must be accommodated

Other States

**General Patterns**:

• Most states have breach notification laws (timelines vary)
• Many prefer or require US-based data storage
• State privacy laws increasingly common
• Public records laws vary significantly
• Some states have specific sector requirements (education, health, criminal justice)

Common State Requirements

Data Residency

**Strict (Data Must Remain in State)**:

• Rare, but some states for specific data types

**US-Based (Data Must Remain in US)**:

• Common requirement
• Impacts choice of cloud regions
• Backup/DR locations also restricted

**No Restriction**:

• Some states allow international if adequate protections

**Impact on CSPs**:

• Must document data storage locations
• Compliance with state restrictions
• May need state-specific deployments

Privacy and Breach Notification

**State Privacy Laws**:

• CCPA (California)
• SHIELD Act (New York)
• CPA (Colorado)

-