SPECIALTY COURSE · RELEASING NOVEMBER 2026
State and Local Government Cloud
GovRAMP, criminal justice information, federal tax information and the data each agency holds.
All coursesOpens November 2026
You will get the most from it if you are…
- Security officers, architects and program managers in state agencies, counties, cities, tribal governments, school systems and public universities
- Procurement and contract leads who write or buy cloud services for state and local government
- Cloud providers and integrators whose services hold state or local government data
- Anyone who has taken the Foundations course and works with criminal justice, tax, health or student records
What it covers.
- 01How state and local government decidesNo single regulator, and procurement as the place policy binds
- 02GovRAMPThe pathways, and what a provider's status does and does not mean
- 03Criminal justice informationThe CJIS Security Policy: no certificate, screening, audits and the 2027 milestone
- 04Federal tax informationPublication 1075, the 45-day notice and the cloud conditions, with the 2026 draft
- 05The rest of the data, and the boundaryHealth, student and election data, and one boundary read per regime
- 06Running it with a small teamOne calendar, one mapped control set and a monthly monitoring habit
8 short lessons, part by part.
How state and local government decides
- No single regulator
- Describe who sets cloud rules for a state or local agency: the legislature, the state chief information officer, procurement and the federal programs whose data the agency holds
- Explain why the regimes that apply follow the data, not the agency's name
- Ask the three first questions on any state or local cloud program: whose data, who decides, and what the contract says
Job aid: No single regulator: a one-page guide
- Procurement is where policy binds
- Explain why procurement is the main control point for state and local cloud security
- Read a state's cloud security policy as it lands in contracts, using two verified state examples
- Draft the security questions a solicitation should settle before award, including the data-specific terms
Job aid: Procurement is where policy binds: a one-page guide
GovRAMP
- Pathways, and what a status means
- Describe GovRAMP: its rename from StateRAMP, who it serves, and its pathways from security snapshot to authorization
- Read a provider's GovRAMP claim precisely: product, pathway, level, scope, date and monitoring status
- Explain what a status does not do: it is not a federal authorization and not the buying government's decision
Job aid: GovRAMP: a one-page guide
Criminal justice information
- The CJIS Security Policy
- Describe the FBI CJIS Security Policy as of October 2026: version 6.1, its control families, and the priority requirements still phasing in
- Name the deciders and auditors: the CJIS Division, the state CJIS Systems Agency, and the agency itself
- Explain how key ownership decides which provider staff must be screened, and what the policy says about where data may be stored
Job aid: The CJIS Security Policy: a one-page guide
Federal tax information
- Publication 1075 and the Office of Safeguards
- Identify federal tax information in a state or local agency and the recurring obligations that come with it
- Apply the cloud requirements of Publication 1075, November 2021 revision, including the 45-day notification
- Describe what the 2026 draft revision would change, and plan for it without treating it as in force
Job aid: Publication 1075 and the cloud: a one-page guide
The rest of the data, and the boundary
- Health, student and election data
- Recognize when health information brings HIPAA into a state or local cloud program, and what it requires of a cloud provider
- Apply the FERPA conditions under which a contractor may handle student records as a school official
- Treat election systems and state privacy and breach laws as classes to identify and route, not rules to memorize
Job aid: Health, student and election data: a one-page guide
- One boundary, many data owners
- Draw a state or local system boundary with three layers of responsibility: provider, shared state platform and agency
- Explain how the tax, criminal justice, health and GovRAMP regimes each read inheritance differently
- Use inner zones to keep the strictest data's rules from spreading across a whole system, and name every crossing
Job aid: One boundary, many data owners: a one-page guide
Running it with a small team
- Evidence and monitoring with a small team
- Build one compliance calendar that holds every regime's recurring dates and the changes already announced
- Reuse one mapped control set and one body of evidence across regimes, without treating a mapping as an equivalence
- Read provider continuous monitoring with a light, regular routine, and place each piece of evidence on the ladder
Job aid: Evidence and monitoring with a small team: a one-page guide
How it is delivered.
- Narrated lessons in short parts you can take one at a time
- A one-page job aid for each lesson
- A short check at the end of each lesson
- A lens for your role: security, cloud architecture or compliance
Narration is AI-generated (OpenAI's Cedar voice). The courses teach preparation and method; they certify no one, grant no approval or authorization, and do not stand in for your assessor, auditor or regulator.