- ClassificationCategoryCloud SecurityDomainCloud SecurityFramework FamilyFedRAMP
- Regulatory ContextTypeCertification / Assurance ProgramLegal InstrumentProgramSectorGovernment SectorIndustryGovernment & Public Sector
- Region / PublisherRegionNorth AmericaRegion DetailTexasPublisherTexas Department of Information Resources (DIR); cybersecurity functions moving to the Texas Cyber Command under H.B. 150 (2025)
- VersioningVersionTX-RAMP Program Manual version 3.1 (Level 2 baseline, 223 controls)Effective DateJanuary 1, 2022 (Level 2 certification required for contracts entered into or renewed on or after that date)Issue DateS.B. 475 signed June 14, 2021; Program Manual 1.0 published October 28, 2021; version 3.1 effective May 14, 2025
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The TX-RAMP Program Manual and Security Plan Workbook are published free by the Texas Department of Information Resources, and the enabling statute is Texas law; the platform links to the official sources.
Framework text is licensed by its publisher and is included only where stated above.
- TX-RAMP Level 2 is the Texas DIR certification for moderate and high impact cloud services handling confidential state data.
- It has been required for contracts entered into or renewed on or after January 1, 2022; the Program Manual is version 3.1.
- FedRAMP Moderate and High authorizations and GovRAMP Core, Ready, Provisionally Authorized, and Authorized statuses are granted Level 2.
- The Level 2 baseline has 223 controls, and a provisional certification lasts 18 months.
- The agency determines scope and level, not DIR.
Overview
TX-RAMP Level 2 is the Texas Risk and Authorization Management Program certification that a cloud computing service needs before a Texas state agency may contract for it when the agency rates the service as a moderate or high impact information resource, which covers confidential and regulated data. The Texas Department of Information Resources (DIR) runs the program under Government Code section 2063.408 (originally section 2054.0593, added by S.B. 475 of the 87th Legislature in 2021 and transferred by H.B. 150 of the 89th Legislature, effective September 1, 2025), and Level 2 has been required for contracts entered into or renewed on or after January 1, 2022; the current Program Manual is version 3.1, effective May 14, 2025.
Level 2 is the second of two certification levels; TX-RAMP Level 1 covers low impact services. DIR confers Level 2 after reviewing the Acknowledgment and Inventory Questionnaire and the Level 2 Assessment Questionnaire with its Security Plan Workbook, or after the service earns an accepted external status. FedRAMP Moderate and High authorizations, and GovRAMP Core, Ready, Provisionally Authorized and Authorized statuses, are granted Level 2. Provisional certification lasts 18 months.
Cloud service providers use Level 2 to sell to Texas state agencies that store confidential data, and agencies use it to decide which services need the stricter baseline. The agency determines scope and level, not DIR. H.B. 150 also names the Texas Cyber Command as the program's operator and moves DIR's cybersecurity functions to it by December 31, 2026; DIR's TX-RAMP page says House Bill 150 transferred them, and Program Manual 3.1 still refers to DIR.
Why does it matter?
Level 2 is the certification that confidential state data depends on. The Program Manual lists examples of confidential information, from dates of birth, driver's license numbers and credit card numbers to attorney-client communications, audit working papers and information excepted from the Texas Public Information Act, and it requires Level 2 whenever the agency rates the service moderate or high. A vendor handling that data without a current Level 2 certification is noncompliant with the contract term that section 2063.408(f) requires.
Key benefits include:
- The stricter baseline
The TX-RAMP Moderate Impact Baseline assesses 223 controls and enhancements, against 117 for Level 1, with the largest increases in access control, system and communications protection and configuration management.
- In force since 2022
Section 4.2 of the Program Manual set January 1, 2022 as the date from which Level 2 services must be certified to contract with state agencies.
- Recognition of other programs
Section 10.2 grants Level 2 to FedRAMP Moderate and High authorizations and to GovRAMP Core, Ready, Provisionally Authorized and Authorized products.
- Quarterly visibility
Level 2 providers send quarterly vulnerability reports through the SPECTRIM Vendor Portal, which DIR shows to the agencies using the service.
- A recorded decision
Agencies document the scope and level determination required by sections 7 and 9, so each cloud purchase has an audit trail.
How does it work?
Under section 9 an agency decides in order: is this a contract for cloud computing services, is the service out of scope under section 7, will it process or store confidential information as defined in 1 Texas Administrative Code section 202.1, and at which impact level has the agency categorized it. Moderate means a serious adverse effect on operations, assets or individuals; High means a severe or catastrophic effect. Both need Level 2, and the manual adds that agencies must ensure that high impact systems also have appropriate control requirements.
A provider submits the TX-RAMP Assessment Request form (section 12). DIR approves the Acknowledgment and Inventory Questionnaire, may grant provisional certification, then launches the Level 2 assessment questionnaire with the Security Plan Workbook describing each of the 223 controls, boundary and data flow diagrams, and a plan of action and milestones (POA&M) for each deficient control. Under section 16.5, a service with a SOC 2 Type 2, HITRUST validated or PCI DSS audit may get a tailored questionnaire with reduced documentation, though certification is not guaranteed.
Level 2 certification lasts three years (section 21) and is followed by quarterly vulnerability reporting. A service certified through FedRAMP or GovRAMP does not send monitoring artifacts to DIR (section 18.1), but it keeps the certification only while that status lasts, and the provider must tell DIR if it is lost (section 20). Breach notice to DIR is due within 48 hours, and a breach affecting 250 or more Texans also goes to the Attorney General.
Key Elements
- Level 2 baseline (section 8)
The TX-RAMP Moderate Impact Baseline, 223 controls and enhancements across 17 NIST SP 800-53 families, listed in Appendix A.
- Level determination (section 9)
Agency decision path ending in Low for Level 1 and Moderate or High for Level 2, with the manual's own impact definitions.
- Certification via external RAMPs (section 10.2)
FedRAMP Authorized Moderate or High, and the four GovRAMP statuses, give Level 2; FedRAMP Ready or In Process give provisional; FedRAMP LI-SaaS does not carry over.
- Provisional certification (sections 11 and 13)
Eighteen months on DIR approval of the Acknowledgment and Inventory Questionnaire, extendable by six months at DIR's discretion; agencies may also sponsor a 60-day interim certification in SPECTRIM.
- Vulnerability reporting (section 18.2)
Quarterly reports by CVSS severity, with remediation or mitigation plans for high and critical findings.
- Transitional Grace Period (section 14)
If certification lapses or is revoked, an agency may follow a documented transition plan of up to 24 months and report its use to DIR.
What does it cover?
TX-RAMP Level 2 applies to cloud computing services, as defined in Government Code section 2063.408(a), that process confidential or regulated data of a Texas state agency and are rated moderate or high impact. Each service needs its own certification inside its boundary, and a SaaS product does not inherit the certification of its infrastructure provider (section 17.2). Out of scope are services in the section 7 categories, managed services and custom applications built for an agency, which must still meet the control baselines in the Security Control Standards Catalog.
What are its objectives?
Section 2063.408(b) sets the purpose, and the Program Manual describes how DIR carries it out.
Provide a standardized approach to security assessment, authorization and continuous monitoring of cloud services that process state agency data.
Accept compliance shown through a federal program or another state's program that DIR approves.
Require agencies to contract only for services that hold the certification for their impact level.
Keep Level 2 services under quarterly vulnerability reporting and 48-hour breach notice.
Leave scope and level decisions with the agency that owns the data.
Framework in Context
TX-RAMP sits within DIR's state security framework alongside the Texas DIR Security Control Standards Catalog and the Texas Cybersecurity Act (Government Code Chapter 2054). Level 2 baselines follow NIST SP 800-53 Rev. 5 and 1 Texas Administrative Code Chapter 202, and the Program Manual recognizes FedRAMP and GovRAMP, the name under which StateRAMP now operates; see the GovRAMP page. Breach notice cross-refers to Texas Business and Commerce Code Chapter 521, section 521.053. The lighter level is TX-RAMP Level 1. Version 2.0 of the manual (October 20, 2022) aligned the controls to Rev. 5.
Common Framework Mappings
Organizations map TX-RAMP controls to the frameworks below so that one set of controls and evidence serves Texas agencies, FedRAMP and other cloud security reviews.
Mapped frameworks include:
CIS Controls v8.1
CSA CCM v4
FISMA
FedRAMP Rev. 5
HITRUST CSF v11.5
ISO 27001:2022
NIST CSF 2.0
NIST 800-171 Rev. 3
NIST 800-53 Rev.5
How SmartSuite Supports TX-RAMP Level 2
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold the 223-control Level 2 baseline with owners and evidence for the Security Plan Workbook, Cyber & IT Risk to track vulnerabilities and POA&M items for the quarterly SPECTRIM report, and Third Party Risk Management to track the TX-RAMP, FedRAMP or GovRAMP status of each cloud supplier.
Level 2 Control Workbook
Hold each baseline control with its implementation description, owner, inherited-control note and evidence for the Security Plan Workbook.
Level Determination Record
Capture the section 9 answers, the data classification, the moderate or high rating and the agency's documented scope decision.
Quarterly Vulnerability Report
Compile identified, remediated and open vulnerabilities by CVSS severity, with remediation or mitigation plans for high and critical items.
POA&M Register
Log each deficient control with milestones and due dates, and review it at least quarterly as section 15.4 expects.
External Status Tracker
Record FedRAMP or GovRAMP status for each service, the date it was granted and the duty to tell DIR if it is lost.
Breach and Change Clock
Start the 48-hour DIR notice, the Attorney General notice for 250 or more Texans and the 30-day significant change report from one incident or change record.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
FISMA (Pub. L. 113-283, 2014) makes U.S. federal agency heads responsible for securing their systems, with OMB oversight, DHS directives, NIST standards and annual IG evaluation.
HITRUST CSF v11.5.0 (April 2025) is HITRUST's certifiable security and privacy framework: 14 control categories, e1, i1 and r2 assessments; superseded by v11.9.0.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For TX-RAMP Level 2 (Texas Risk and Authorization Management Program)
Section 9 of the Program Manual sends the service to Level 2 when the Texas state agency categorizes it as a moderate or high impact information resource, and to Level 1 when it is low impact. The test turns on whether the service processes or stores confidential information, as defined in 1 Texas Administrative Code section 202.1. The agency makes and documents the decision.
Appendix A of Program Manual 3.1 counts 223 controls and enhancements for Level 2 and 117 for Level 1, grouped in the NIST SP 800-53 families. Level 2 has 33 in access control, 23 in system and communications protection, 21 in configuration management and 16 each in system and services acquisition and in identification and authentication. Control changes must be implemented within 18 months of adoption (section 22.3).
Yes. Section 10.2 grants Level 2 to FedRAMP Moderate or High authorizations and to GovRAMP Core, Ready, Provisionally Authorized and Authorized products, and says DIR reconciles its records with both programs. FedRAMP Ready and In Process give provisional certification, and FedRAMP LI-SaaS does not carry over. If the external status is lost, the TX-RAMP certification is revoked.
Section 18.2 requires quarterly vulnerability reports through the SPECTRIM Vendor Portal, and section 18.3 requires notice to DIR within 48 hours of a breach of system security. Significant changes go to DIR within 30 days under section 18.4. Certification lasts three years under section 21, and a provider can start recertification up to 12 months before the end date.
Section 11.2 says a lapse leaves the service noncompliant, and section 2063.408(f) requires agencies to make maintaining certification a contract term. DIR may extend provisional certification by six months (section 13.1), and an agency can use the section 14 Transitional Grace Period, with a plan of no more than 24 months, to move to a certified service.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.