The Texas Risk and Authorisation Management Program is mandatory for cloud service providers selling to Texas state agencies. TX-RAMP provides a standardised security assessment framework modelled on FedRAMP for the Texas state government market.
What is TX-RAMP?
The Texas Risk and Authorisation Management Program (TX-RAMP) is a mandatory security certification programme for cloud service providers that store, process, or transmit data for Texas state agencies. Established by the Texas Department of Information Resources (DIR), it is modelled on FedRAMP and based on NIST 800-53 controls.
TX-RAMP has two levels: Level 1 (lower sensitivity data, self-assessment) and Level 2 (higher sensitivity data, third-party assessment). All cloud service providers must be TX-RAMP certified before Texas state agencies can procure their services.
TX-RAMP certification is listed on the DIR Cloud Services catalogue, enabling state agencies to procure certified services with confidence. Organisations with existing FedRAMP authorisation can leverage that investment to accelerate TX-RAMP certification.
Compliance requirements
TX-RAMP requirements are based on NIST 800-53 controls, adapted for the Texas state government context with two impact levels.
Implement controls to limit access to state agency information systems to authorised users, aligned to NIST 800-53 requirements at the applicable impact level.
Establish and maintain secure baseline configurations for all systems processing state agency data, with formal change management processes.
Establish an incident response capability with mandatory reporting requirements to the Texas Department of Information Resources (DIR).
Conduct risk assessments using TX-RAMP-specific methodologies, including continuous monitoring and vulnerability management.
Implement controls to protect state agency data in transit and at rest, including encryption requirements aligned to the applicable TX-RAMP level.
Implement controls to manage risks from the supply chain, including third-party service providers and software components.
Audit process
Netru manages the complete TX-RAMP certification journey, from determining your required level through to DIR certification and ongoing monitoring.
We determine the appropriate TX-RAMP level (Level 1 or Level 2) based on the sensitivity of state agency data your system processes.
We categorise your cloud system and identify all applicable TX-RAMP control requirements for your impact level.
We draft your comprehensive SSP documenting implementation of all applicable controls for your TX-RAMP level.
Your compliance manager guides implementation of required controls, with evidence collection throughout.
We manage the engagement with a TX-RAMP-approved assessor to conduct the formal security assessment.
We prepare the certification package for submission to the Texas Department of Information Resources and manage the approval process.
How Netru delivers it
Our team leverages FedRAMP and NIST 800-53 expertise to deliver TX-RAMP certification efficiently. We manage the entire process from level determination to DIR certification, helping you access the Texas state government market.
Talk to our teamBefore you talk to anyone