Key Facts
- Regulator
- Texas Department of Information Resources (DIR), which administers TX-RAMP under Texas Government Code Section 2063.408. A 2025 law (HB 150) transfers DIR's cybersecurity duties, including TX-RAMP, to Texas Cyber Command, with DIR continuing until the transfer memorandum says otherwise.
- Latest version
- TX-RAMP Program Manual Version 4.0 (third major revision)
- Effective
- 12 February 2026
- Official text
- dir.texas.gov ↗
What is TX-RAMP?
TX-RAMP is the Texas Risk and Authorization Management Program, the state programme for assessing, certifying and monitoring cloud computing services that handle state agency data. The Texas Department of Information Resources (DIR) administers it. It applies to Texas state agencies, universities and public community colleges, and to the cloud providers they contract with.
The current version is the TX-RAMP Program Manual Version 4.0, the third major revision, effective 12 February 2026. TX-RAMP is set up under Texas Government Code Section 2063.408. Certified services stay under continuous monitoring, so the programme does more than check a point in time.
DIR has announced no further revision. The owner is changing, though. A 2025 law, HB 150, transferred DIR's cybersecurity functions, including TX-RAMP, to Texas Cyber Command. The manual lets DIR keep running the programme until a memorandum between the two bodies moves the duties across, and the TX-RAMP pages stay on DIR's site while the handover happens in phases.
The official programme page is on the DIR website.
Why it matters
The renewal arrives from a Texas university or agency. The contract is the same, the service is the same, and a new clause asks for a TX-RAMP certification you do not hold.
That is how most providers meet TX-RAMP. Certification requirements apply to all contracts for cloud computing services that a Texas state agency enters into or renews, so the buyer's procurement calendar sets your deadline.
A contract clause is a deadline you didn't set.
Who it applies to
TX-RAMP is mandatory by Texas statute for state agencies, institutions of higher education and public community colleges. Cloud providers meet it through the contracts those bodies enter into or renew, and they must hold a TX-RAMP certification for in-scope cloud computing services.
Only cloud computing services are in scope: DIR states that other products and services are not subject to TX-RAMP. A firm that sells only to private Texas businesses, or sells non-cloud products, does not meet it.
For an ISO 27001 holder, the relationship is a shortcut, not a substitute. An ISO 27001 certificate or a SOC 2 Type 2 report can qualify a service for TX-RAMP's Fast Track route, which can cut the documentation a provider submits. It does not replace the TX-RAMP assessment, and qualifying does not guarantee certification.
The UK position
TX-RAMP has no UK statutory footprint. A UK firm meets it only as a cloud provider contracting with a Texas state agency, university or public community college, which can require certification in the contract. A UK firm with no Texas public-sector customers rarely meets TX-RAMP at all.
Key requirements
TX-RAMP asks a cloud provider to demonstrate compliance with defined security criteria, then keep that certification in good standing. The structure has four parts.
- Two certification levels. Level 1 is for low-impact systems and public or non-confidential information. Level 2 is for confidential or regulated data in moderate or high impact systems.
- Two control baselines. The manual defines a low impact baseline for Level 1 and a moderate or high impact baseline for Level 2. The level a provider needs follows the data the service handles for the customer.
- Assessment and certification. In the standard route, the provider submits assessment responses and documentation to DIR for review. Certifications for Level 1 and Level 2 are valid for three years, subject to recertification.
- Continuous monitoring. Certified providers enter continuous monitoring. A provider must notify TX-RAMP within 48 hours of becoming aware of a breach of system security.
Routes that reuse other assessments
TX-RAMP recognises work a provider has already done, in two ways:
- Reciprocity. Providers with a FedRAMP or GovRAMP (formerly StateRAMP) authorisation can request a corresponding TX-RAMP status.
- Fast Track. A third-party assessment from the last 24 months can qualify a service for a lighter review: SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, CSA STAR II, HITRUST, PCI DSS or FISMA. The full list is in the Program Manual.
Eligibility, including which services and customers are in scope, is set out on DIR's eligibility page.
A certificate covers a service, not a company. Read the scope before you quote it back to a customer.
Frequently asked questions
TX-RAMP is the Texas Risk and Authorization Management Program, the certification scheme Texas public bodies use for cloud services that process their data. Alongside Level 1 and Level 2, TX-RAMP grants a provisional certification, which lets an agency sign or renew a contract before the service holds full certification. DIR publishes a list of certified cloud services.
TX-RAMP Level 1 is the lower of the two certification levels, for low-impact systems and public or non-confidential information. A provider reaches TX-RAMP Level 1 when DIR approves its Acknowledgment and Inventory Questionnaire and its Level 1 Assessment Questionnaire, or by holding the matching GovRAMP or FedRAMP authorisation.
TX-RAMP Level 2 is required when a Texas state agency classes a cloud service as a moderate or high impact information resource under the Texas Administrative Code, usually because it handles confidential or regulated data. The provider answers the Level 2 Assessment Questionnaire, which covers the larger moderate or high impact control baseline.
No. ISO 27001 can qualify a cloud service for the TX-RAMP Fast Track route, but TX-RAMP keeps full discretion to accept or reject it, and the service still goes through a TX-RAMP review. The assessment must reflect the security posture of the service being certified, so check that your ISO 27001 scope covers that service.
Yes. A service listed on the FedRAMP marketplace or the GovRAMP authorised products list can request a reciprocal TX-RAMP certification. That certification lasts only as long as the outside status: if the service loses its FedRAMP or GovRAMP status, TX-RAMP revokes it. Reciprocal holders do not send continuous monitoring evidence to TX-RAMP.
The current document is the TX-RAMP Program Manual Version 4.0, effective 12 February 2026. TX-RAMP has had three major revisions since the first manual in October 2021. Version 4.0 updated the recertification, continuous monitoring and significant change processes; earlier revisions aligned the controls with NIST SP 800-53 Revision 5 and added GovRAMP.