- ClassificationCategoryCloud SecurityDomainCloud SecurityFramework FamilyFedRAMP
- Regulatory ContextTypeCertification / Assurance ProgramLegal InstrumentProgramSectorGovernment SectorIndustryGovernment & Public Sector
- Region / PublisherRegionNorth AmericaRegion DetailTexasPublisherTexas Department of Information Resources (DIR); cybersecurity functions moving to the Texas Cyber Command under H.B. 150 (2025)
- VersioningVersionTX-RAMP Program Manual version 3.1 (Level 1 baseline, 117 controls)Effective DateJanuary 1, 2024 (Level 1 certification required for contracts); program statute effective for contracts from January 1, 2022Issue DateS.B. 475 signed June 14, 2021; Program Manual 1.0 published October 28, 2021; version 3.1 effective May 14, 2025
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The TX-RAMP Program Manual and Security Plan Workbook are published free by the Texas Department of Information Resources, and the enabling statute is Texas law; the platform links to the official sources.
Framework text is licensed by its publisher and is included only where stated above.
- TX-RAMP Level 1 is the Texas DIR certification a cloud service needs when a state agency rates it a low impact information resource.
- Level 1 certification is required for contracts entered into or renewed on or after January 1, 2024.
- DIR confers it after reviewing the Acknowledgment and Inventory Questionnaire and the Level 1 Assessment Questionnaire, or on a corresponding FedRAMP authorization.
- The agency, not DIR, decides whether a service is in scope and which level applies; a provisional certification lasts 18 months.
- H.B. 150 (2025) names the Texas Cyber Command as the program's operator.
Overview
TX-RAMP Level 1 is the Texas Risk and Authorization Management Program certification that a cloud computing service needs before a Texas state agency may contract for it when the agency rates the service as a low impact information resource. The Texas Department of Information Resources (DIR) runs the program under Government Code section 2063.408 (originally section 2054.0593, added by S.B. 475 of the 87th Legislature in 2021 and transferred by H.B. 150 of the 89th Legislature, effective September 1, 2025), and the Program Manual (version 3.1, effective May 14, 2025) requires Level 1 certification for contracts entered into or renewed on or after January 1, 2024.
The program has two certification levels. Level 1 covers low impact information resources; TX-RAMP Level 2 covers moderate and high impact. Each independent cloud computing service needs its own certification, and DIR confers it after reviewing the Acknowledgment and Inventory Questionnaire and the Level 1 Assessment Questionnaire with its Security Plan Workbook, or after the service earns a corresponding FedRAMP authorization. A provisional certification lasts 18 months.
Cloud service providers use Level 1 to sell to Texas state agencies, and agencies use it to scope and document their own cloud purchases: the agency, not DIR, decides whether a service is in scope and which level applies. H.B. 150 also names the Texas Cyber Command as the program's operator and moves DIR's cybersecurity functions to it by December 31, 2026; DIR's TX-RAMP page says House Bill 150 transferred them, and Program Manual 3.1 still refers to DIR.
Why does it matter?
A software vendor that answers a Texas agency's solicitation needs to know in advance whether the service is in scope, which level applies and how long certification takes. The Program Manual answers each question: the agency decides scope and level, and a low impact rating means Level 1. A lapse in certification leaves the vendor noncompliant, and section 2063.408(f) requires agencies to make maintaining certification a contract term. Level 1 became mandatory on January 1, 2024, two years after Level 2.
Key benefits include:
- A statutory duty on agencies
Section 2063.408(e) bars a state agency from entering or renewing a contract for a cloud computing service that is subject to the program unless the vendor shows compliance.
- Two levels, one decision
Section 9 of the Program Manual maps the agency's impact rating to the level: Low to Level 1, Moderate and High to Level 2.
- A defined scope
Section 6 uses the NIST SP 800-145 definition of a cloud computing service, and section 7 lists categories an agency may treat as out of scope.
- Time to contract
Provisional certification under section 11 lets agencies contract for 18 months while the vendor completes the assessment.
- Reuse of other authorizations
A FedRAMP Low authorization yields Level 1 under section 10.2, and other FedRAMP statuses can yield a provisional certification.
How does it work?
Under section 9 the agency works through a decision path. Is the contract for cloud computing services? Does the service fall in a section 7 out-of-scope category? Will it process or store confidential information as defined in 1 Texas Administrative Code section 202.1? If so, the agency's impact rating decides the level: a low impact information resource, one whose loss would have a limited adverse effect, needs Level 1. Services that handle only login data, or that process personal information solely for purchases, reservations, bookings or multifactor authentication, may be out of scope.
A provider starts by submitting the TX-RAMP Assessment Request form on DIR's site (section 12). DIR creates an engagement record and sends the Acknowledgment and Inventory Questionnaire, which may lead to provisional certification. DIR then launches the assessment questionnaire, which includes the Security Plan Workbook describing how each baseline control is implemented, boundary and data flow diagrams, and a plan of action and milestones (POA&M) for each deficient control. DIR reviews submissions in the order received and does not review incomplete ones.
Once certified, Level 1 is valid for three years (section 21), and DIR emails the contact 12 and six months before it ends. The provider sends annual vulnerability reports through the SPECTRIM Vendor Portal (section 18.2), reports a significant change within 30 days, and notifies DIR within 48 hours of a breach of system security. Failure to report a breach, or to provide required monitoring documents, can lead to revocation (section 20).
Key Elements
- Level 1 baseline (section 8)
The TX-RAMP Low Impact Baseline: 117 controls and enhancements assessed, set out in Appendix A against NIST SP 800-53 Rev. 5 families.
- Compliance date (section 4.1)
Services subject to Level 1 must be certified to contract with state agencies on or after January 1, 2024.
- Certification paths (section 10)
A DIR-conducted assessment, or a corresponding external RAMP authorization; FedRAMP LI-SaaS does not carry over.
- Provisional certification (section 11)
Granted on approval of the Acknowledgment and Inventory Questionnaire, valid 18 months, and not an indication of compliance with the baseline.
- Fast Track (section 16)
DIR may use a SOC 2 Type 2 report, a HITRUST validated assessment or a PCI DSS Report on Compliance completed within the previous 24 months to certify Level 1 wholly or in part.
- Monitoring and revocation (sections 18 to 20)
Annual vulnerability reports, 48-hour breach notice to DIR, 30-day significant change reports, appeals to the State Chief Information Security Officer and then the DIR Executive Director.
What does it cover?
TX-RAMP applies to cloud computing services, as defined in Government Code section 2063.408(a), that process the data of a Texas state agency. Level 1 covers the services an agency rates as low impact and that are not out of scope under section 7. SaaS products do not inherit the certification of the infrastructure they run on and need their own, though they may inherit applicable controls (section 17.2). Managed services and custom applications built for an agency are out of scope (sections 7.3 and 7.4).
What are its objectives?
Section 2063.408(b) states the program's purpose, and the Program Manual turns it into practice.
Provide a standardized approach to security assessment, authorization and continuous monitoring of cloud computing services that process state agency data.
Let a vendor show compliance through a federal risk and authorization management program or one of another state that DIR approves.
Require each Texas state agency to contract only for certified services subject to the program.
Keep certified services monitored through vulnerability reporting and prompt breach notice.
Leave scope and level decisions with the agency that owns the data.
Framework in Context
TX-RAMP sits within DIR's state security framework alongside the Texas DIR Security Control Standards Catalog and the Texas Cybersecurity Act (Government Code Chapter 2054). Its baselines follow NIST SP 800-53 Rev. 5 and the 1 Texas Administrative Code Chapter 202 standards. Breach notice follows Texas Business and Commerce Code Chapter 521, section 521.053, and Level 1 sits below TX-RAMP Level 2. The Program Manual also recognizes GovRAMP, which operates as StateRAMP's successor name; see the GovRAMP page. Version 1.0 of the manual dates from October 28, 2021 and version 2.0 from October 20, 2022.
Common Framework Mappings
Organizations map TX-RAMP controls to the frameworks below so that one set of controls and evidence serves Texas agencies and other cloud security reviews.
Mapped frameworks include:
CIS Controls v8.1
CSA CCM v4
FedRAMP Rev.5 Low
ISO 27001:2022
NIST CSF 2.0
NIST 800-171 Rev. 3
NIST 800-53 Rev.5
How SmartSuite Supports TX-RAMP Level 1
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold the Level 1 baseline controls with owners and evidence for the Security Plan Workbook, Cyber & IT Risk to track vulnerabilities for the annual SPECTRIM report, and Third Party Risk Management to record which cloud suppliers need a TX-RAMP status for Texas contracts.
Level 1 Control Workbook
Hold each baseline control with its implementation description, owner, status and evidence, ready to enter into the Security Plan Workbook.
Scope and Level Determination
Record the section 9 questions, the agency's impact rating, any section 7 out-of-scope reason and the date of the decision.
POA&M Register
Log each deficient control with milestones and due dates, and review it at least quarterly as section 15.4 expects.
Annual Vulnerability Report
Compile identified, remediated and existing vulnerabilities by CVSS severity for the SPECTRIM Vendor Portal submission.
Incident and Change Clock
Start the 48-hour breach notice to DIR and the 30-day significant change report from a single incident or change record.
Certification Calendar
Track provisional expiry, the three-year certification end date and the 12-month recertification window with reminders.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
FedRAMP Rev. 5 High baseline: the 410 NIST SP 800-53 Rev. 5 controls and enhancements for high-impact cloud services, FedRAMP parameters and the Consolidated Rules for 2026 dates.
The FedRAMP Rev5 Moderate baseline is the set of 323 NIST SP 800-53 Rev. 5 controls a cloud service must implement and have assessed for moderate-impact federal data.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For TX-RAMP Level 1 (Texas Risk and Authorization Management Program)
A cloud service provider whose service a Texas state agency rates as a low impact information resource and that is not out of scope. Government Code section 2063.408(e) bars agencies from entering or renewing such contracts without compliance, and section 4.1 of the Program Manual makes Level 1 mandatory for contracts on or after January 1, 2024. The agency decides scope and level.
Section 10 gives two paths. DIR can review the Acknowledgment and Inventory Questionnaire and the Level 1 Assessment Questionnaire with its Security Plan Workbook, or the service can earn a corresponding external authorization, such as FedRAMP Low. FedRAMP LI-SaaS authorizations do not carry over, and GovRAMP Core, Ready, Provisionally Authorized and Authorized statuses are granted Level 2.
Section 11 says provisional certification follows DIR approval of the Acknowledgment and Inventory Questionnaire and lasts 18 months. It lets agencies contract while the provider completes the assessment, but it does not indicate compliance with the baseline. DIR may extend it by six months, and a lapse leaves the service noncompliant.
Section 16 allows Fast Track: DIR accepts a SOC 2 Type 2 report, a HITRUST Authorized External Assessor validated assessment or a PCI DSS Report on Compliance completed within the previous 24 months, and may certify Level 1 wholly or in part on it. DIR keeps discretion, security artifacts for the underlying IaaS do not qualify, and DIR cannot sign nondisclosure agreements.
Section 18.2 requires annual vulnerability reports through the SPECTRIM Vendor Portal, with severity from the NIST CVSS scale. Section 18.3 requires notice to DIR within 48 hours of a breach of system security, and section 18.4 requires significant changes to be reported within 30 days. Certification lasts three years (section 21), and failure to report can lead to revocation (section 20).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.