TX-RAMP

TX-RAMP (Texas Risk and Authorization Management Program) is the Texas Department of Information Resources program that certifies cloud computing services before Texas state agencies, public universities and community colleges may contract for them. It was created under Texas Government Code section 2054.0593.

There are two certification levels, Level 1 for public or low-impact data and Level 2 for confidential or moderate and high-impact data, plus a Provisional certification valid for 18 months that lets procurement proceed while full certification is pursued. The contracting agency decides the level required.

Unlike FedRAMP, DIR performs the assessment itself from the provider's questionnaire responses and supporting evidence; engaging a 3PAO is not required. In writing, a provider needs control responses to the TX-RAMP assessment criteria (drawn from NIST SP 800-53), security policies and procedures, an incident response plan and vulnerability management reporting.

FedRAMP and GovRAMP authorizations no longer convert automatically; since October 30, 2024 providers must submit a reciprocity request that DIR validates.