TX DIR Control Standards

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-02-28 in 111 days Controls added in Version 2.2 (such as CP-07 Alternate Processing Site and SI-08 Spam Protection) must be implemented
2. 2025-08-28 Version 2.2 of the catalog takes effect

1. 2025-08-28
   Security Control Standards Catalog Version 2.2 RevisionCurrent

   Added seven controls, renumbered controls with leading zeros and updated the baselines in the Appendix to the current NIST SP 800-53B. source

   More

   • Added CP-07, CP-09(2), CP-09(3), PM-05(1), PM-11, PM-22 and SI-08.
   • Corrected the link to the NIST Risk Management Framework.
2. 2023-05-18
   Security Control Standards Catalog Version 2.1 Revision

   DIR Board approval of Version 2.1, which added references and controls and modified implementation language. source

3. 2022-01-20
   Security Control Standards Catalog Version 2.0 Major version

   DIR Board approval of Version 2.0, aligning control language with NIST SP 800-53 Revision 5 and introducing the SR (supply chain) family. source

4. 2016-02-26
   Security Control Standards Catalog Version 1.3 Errata

   Corrected examples for several controls and 1 TAC 202 references, and added Program Management controls to Appendix A. source

5. 2015-03-17
   Security Control Standards Catalog Version 1.1 (final 1.0) Major version

   Released the final Version 1.0, after draft versions in 2014. source

The minimum security controls for every Texas state agency and institution of higher education, aligned with NIST SP 800-53 Revision 5.

Baseline

The catalog specifies the minimum baselines for required information security controls for all State of Texas agencies and their information resources. source

All controls required

The NIST baseline designation is informational only; all controls in the catalog are required for agency systems, regardless of the associated NIST baseline. source

Stricter standards

An agency head may apply more stringent standards that contain at least the department's standards or are consistent with federal law and other listed sources. source

Privacy controls

The catalog has not adopted the privacy-specific control families of NIST SP 800-53 Revision 5. source

Each control carries a required-by date; exceptions follow 1 TAC 202, and agencies file an information security plan with the Texas Cyber Command every even-numbered year.

Required-by dates

New controls, and existing controls with more than administrative changes, must be in place no later than 18 months after the catalog's adoption. source

Exceptions

Any exception to a control shall be approved, justified and documented in accordance with 1 Texas Administrative Code chapter 202. source

Security plan

Each state agency submits its information security plan to the Texas Cyber Command not later than 1 June of each even-numbered year (Government Code 2063.403). source

Assessment and pen test

At least once every two years each state agency other than higher education completes an information security assessment and a penetration test (Government Code 2063.409). source

Earlier versions' controls stay required until their replacements are implemented or their dates pass.

Previous versions

Controls required by previous versions remain required until the agency implements the updated control, the update's implementation date passes, or the agency can defensibly justify that the old control was superseded. source

1. Standard Security Control Standards Catalog, Version 2.2 (PDF)
2. Standard Security Control Standards Catalog (DIR resource library)
3. Law text Government Code chapter 2063 (Texas Cyber Command)

1. NIST SP 800-53

   The federal control catalog that the Texas catalog follows; Texas marks every listed control as required, whatever its NIST baseline.

2. TX-RAMP

   Texas certification of cloud services sold to state agencies, rather than the controls on agencies' own systems.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TX DIR Control Standards (RSS)