Compliance / TX-RAMP
Sell cloud services to Texas state agencies with TX-RAMP.
The Texas Risk and Authorization Management Program, or TX-RAMP, sets security requirements for cloud computing services used by Texas state agencies. The program is run by the Texas Department of Information Resources (DIR), and agencies generally cannot contract for covered cloud services that lack the required certification.
We help SaaS and cloud vendors work out which level applies, close gaps against the control baseline and prepare a complete, well-documented submission.
At a glance
- Administered by
- Texas Department of Information Resources (DIR)
- Applies to
- Cloud computing services used by Texas state agencies
- Levels
- Level 1 for lower-risk data, Level 2 for confidential or regulated data
- Control basis
- Derived from NIST SP 800-53
- Reuse
- An existing FedRAMP authorization may support a TX-RAMP certification
TX-RAMP
Why it matters for Texas vendors
State agencies buy a large share of their software as cloud services, and TX-RAMP certification is a condition of many of those contracts. Vendors that plan for it early avoid watching a deal wait on a pending review.
The work overlaps heavily with SOC 2, ISO 27001 and FedRAMP. If you already have one of those, much of your documentation can be reused.
How we help
Level determination
Start with the right target.
- Data classification review
- Level 1 or Level 2 determination
- Scope definition for the cloud offering
Gap assessment
Measure against the control baseline and reuse what you have.
- Assessment against the TX-RAMP control baseline
- Mapping from existing SOC 2, ISO 27001 or FedRAMP work
- Remediation roadmap
Documentation and submission
A complete package with fewer back-and-forth questions.
- System security documentation
- Policies and procedures
- Security questionnaire preparation
- Review of the package before it goes to DIR
Continuous monitoring
Keep the certification in good standing.
- Vulnerability management
- Annual reviews
- Change notification processes
- Incident reporting procedures
Certification decisions belong to DIR
DIR reviews submissions and grants TX-RAMP certification. We help you prepare an accurate, complete package, but no consultant can guarantee the outcome.
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
- Penetration Testing & Offensive SecurityPenetration testing, red teaming and adversary simulation that show what an attacker could actually reach.
FAQ
Frequently asked questions
Can we reuse our SOC 2 or FedRAMP work?
Often, yes. Many TX-RAMP controls map directly to SOC 2, ISO 27001 and FedRAMP requirements. We map what you already have so you only build what is missing.
Does TX-RAMP apply to cities and counties?
TX-RAMP is a requirement for state agencies. Local governments are not bound by it in the same way, although some use it as a reference point in their own vendor reviews. Check the requirements in each solicitation.
Find out where you stand on TX-RAMP.
A readiness review shows what an assessor would find today and what it will take to close the gaps.