TX-RAMP

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-02-12 TX-RAMP Program Manual 4.0 takes effect
2. 2025-09-01 H.B. 150 takes effect, redesignating the TX-RAMP statute as Government Code section 2063.408 under the Texas Cyber Command
3. 2025-05-14 Program Manual 3.1 adds GovRAMP Core
4. 2021-06-14 S.B. 475 takes effect, creating the state risk and authorization management program

1. 2026-02-12
   TX-RAMP Program Manual 4.0 Major versionCurrent

   Third major revision: updated recertification, continuous monitoring and significant change processes, with clarity edits and an acronyms list. source

2. 2025-05-14
   TX-RAMP Program Manual 3.1 Revision

   First minor revision, adding GovRAMP Core. source

3. 2023-12-01
   TX-RAMP Program Manual 3.0 Major version

   Second major revision, adding the POA&M requirement, the Fast Track assessment and a transitional grace period. source

   More

   • Revised StateRAMP/FedRAMP inheritance language and aligned the control impact baselines.
   • Clarified services not subject to TX-RAMP certification.
   • Revised the significant change requirements and added a responsibilities section.
4. 2022-10-20
   TX-RAMP Program Manual 2.0 Major version

   First major revision, aligning controls with NIST SP 800-53 Revision 5 and moving the Level 1 certification requirement date from 1 January 2023 to 1 January 2024. source

   More

   • Added the TX-RAMP Acknowledgement and Inventory and provisional certification extension requests.
5. 2021-10-28
   TX-RAMP Program Manual 1.0 Major version

   Initial publication. source

Every contract a Texas state agency enters or renews for cloud computing services that process its data.

Agencies

TX-RAMP requirements apply to state agencies, institutions of higher education and public community colleges (Government Code 2054.003(13)). source

Contracts

A state agency may not enter or renew a contract for in-scope cloud computing services unless the vendor demonstrates compliance, and the vendor must keep certification for the term of the contract. source

Per service

Each independent cloud computing service needs its own certification, scoped to the components within the boundary of that solution. source

Out of scope

Products that are not cloud computing services; the Program Manual lists cloud offerings that are not in scope, such as non-substantive use of confidential data and custom developed applications. source source

TX-RAMP certifies each cloud service at Level 1 or Level 2, directly or by reciprocity with GovRAMP or FedRAMP; certifications last three years, with continuous monitoring in between.

Level 1

For low impact information resources; achieved through the Level 1 assessment or a corresponding accepted GovRAMP or FedRAMP authorization. source

Level 2

For moderate or high impact resources; achieved through the Level 2 assessment or a corresponding accepted GovRAMP or FedRAMP authorization. source

Provisional

Granted on approval of the Acknowledgment and Inventory questionnaire and effective for 12 months; it does not indicate compliance with the security baseline. source

Validity

Level 1 and Level 2 certifications are valid for three years; an approved recertification runs three years from the previous expiration date. source

Fast Track

Existing reports such as SOC 2 Type 2, HITRUST, a PCI DSS Report on Compliance, ISO 27001, 27017 or 27018, CSA STAR or FISMA can be submitted for a Fast Track assessment. source

Control changes

Providers must implement new or revised controls no later than 18 months after the program formally adopts them. source

Enforced through state contracting and revocation of certification, including for failing to report a breach within 48 hours.

Breach notice

A provider whose certified service has a breach of system security must notify TX-RAMP within 48 hours of becoming aware of it. source

Revocation

Grounds for revoking certification include false or misleading information, presenting non-certified services as certified and failing to report a breach within 48 hours; loss of another program's authorization revokes a reciprocal certification. source

Lapse

A service that does not reach Level 1 or Level 2 before provisional status expires is not certified and is noncompliant, unless the transitional grace period obligations are met. source

1. Guidance TX-RAMP Program Manual 4.0
2. Standard TX-RAMP Control Baselines 2.0 (spreadsheet)
3. Guidance TX-RAMP Certified Cloud Products
4. Guidance TX-RAMP Eligibility and Requirements
5. FAQ TX-RAMP FAQs

1. FedRAMP

   The federal authorization program for cloud services; a FedRAMP authorization can be accepted for TX-RAMP certification.

2. GovRAMP

   The authorization program for US state and local governments; TX-RAMP accepts GovRAMP authorizations for reciprocity.

3. TX DIR Control Standards

   The control baseline for Texas agencies' own systems, rather than a certification of cloud vendors.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TX-RAMP (RSS)