Requirements & evidence
TX-RAMP
Texas's risk and authorization management program for cloud services used by state agencies and public higher education. Level 1, Level 2, and Provisional are service-offering certifications—not company-wide certifications.
- Edition on record
- Program Manual 4.0
- Issuing authority
- Texas Department of Information Resources (opens in a new tab)
- Edition published
- Not stated by the authority
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for cloud services, SaaS, state government, higher education, across US-TX. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Level 1 low-impact baseline
- Level 2 moderate/high-impact baseline
- Provisional certification
- Fast Track assessment
- FedRAMP and GovRAMP reciprocity
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
Texas DIR publishes the program manual and baseline spreadsheets. Pin Manual 4.0 and the applicable Level 1 or Level 2 baseline before normalization.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
TX-RAMP is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; TX-RAMP baselines, assessment questionnaires, reciprocity rules, and certification workflows are not ingested or implemented.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- Program Manual 4.0Current edition on record · Replaces Program Manual 3.1Publication date not recorded
- Program Manual 3.1Superseded editionPublication date not recorded
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.
- Texas Department of Information Resources (opens in a new tab)
Issuing authority and framework publication.
- Edition reference: Program Manual 4.0 (opens in a new tab)
The publication used to establish the recorded edition.
Catalog provenance and record details
Framework record: tx-ramp-program-manual-4.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Level 1 low-impact baseline · Level 2 moderate/high-impact baseline · Provisional certification · Fast Track assessment · FedRAMP and GovRAMP reciprocity.
Record last updated: August 30, 2026.
Common questions
A closer look.
What is TX-RAMP?
Texas's risk and authorization management program for cloud services used by state agencies and public higher education. Level 1, Level 2, and Provisional are service-offering certifications—not company-wide certifications.
Who does TX-RAMP apply to?
TX-RAMP applies to cloud services, SaaS, state government, higher education, US-TX, per Texas Department of Information Resources.
What is the current version of TX-RAMP?
The current edition is Program Manual 4.0, issued by Texas Department of Information Resources. Source: https://dir.texas.gov/information-security/texas-risk-and-authorization-management-program-tx-ramp/tx-ramp-eligibility.
What does an assessment under TX-RAMP require?
No control catalog has been ingested for TX-RAMP yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
TX-RAMP
Program Manual 4.0
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize TX-RAMP requirements, evidence preparation, and review for your assessment scope.