State Requirements
State Cybersecurity & Procurement Requirements
State and local governments add their own cybersecurity and procurement rules on top of the federal baseline. Start with the state-by-state index, or jump to how states use GovRAMP and what local governments require.
By State
A state-by-state index of cybersecurity statutes, agency regulations, NIST/FIPS alignment, GovRAMP participation, and Model Procurement Code use — searchable and filterable.
GovRAMP (formerly StateRAMP)
How states use GovRAMP to authorize cloud service providers, and what its requirements mean for contractors selling to state and local government.
Local Policies
City, county, and special-district cybersecurity and procurement rules that layer on top of state requirements for local-government contractors.
GovConCyber provides plain-language cybersecurity and procurement requirement summaries for all 50 states, with supplemental coverage for District of Columbia and Puerto Rico where source materials are available. Use each page as an educational starting point, then confirm the current solicitation, contract terms, state procurement manual, and agency cybersecurity requirements before relying on any requirement.