Meet the TX DIR Catalog 2.2 controls with evidence ready to show

It is the current edition of the security controls catalog published by the Texas Department of Information Resources, effective 28 August 2025. It lists 173 controls in 19 families, based on NIST SP 800-53 Revision 5, that Texas state agencies and institutions of higher education must implement as the minimum baseline under the Information Security Standards rules in 1 TAC Chapter 202.

Version 2.2 added seven controls: CP-07 Alternate Processing Site, CP-09(2) and CP-09(3) on backup testing and separate storage, PM-05(1) inventory of personally identifiable information, PM-11 mission and business process definition, PM-22 PII quality management and SI-08 spam protection. It also added leading zeros to control numbers and updated the appendix baselines to NIST SP 800-53B, taking the total from 166 to 173.

Texas state agencies and public institutions of higher education must implement the catalog controls for their information resources. The catalog states that all controls are required regardless of the NIST baseline shown. Agencies may adopt stricter controls. Private companies are not directly bound, but suppliers to Texas agencies are often asked to show that their services support the relevant controls.

The seven controls added in version 2.2 carry a required-by date of 28 February 2027, reflecting the catalog's rule that new or materially changed controls must be in place within 18 months of adoption. Controls carried over from earlier versions keep their earlier required-by dates, and agencies must keep meeting previous versions until the updated controls are implemented.

The catalog is the detailed control standard behind the Information Security Standards in 1 TAC Chapter 202. Following House Bill 150, those rules were transferred to Texas Cyber Command and renumbered as 1 TAC Chapter 477 from 1 August 2026, with no change to their wording. Exceptions to catalog controls must still be justified and documented under those rules.

The catalog adopts NIST SP 800-53 Revision 5 control language for a selected set of controls and adds Texas State Implementation Details, so an existing NIST programme covers much of the work. TX-RAMP is a separate programme that certifies cloud services sold to Texas agencies, while the catalog governs the agencies' own security controls.

It depends on how mature your existing security programme is. An agency already aligned with NIST SP 800-53 mainly needs to check the State Implementation Details and the seven new controls, while one starting from scratch faces work across all 19 families. The catalog itself allows 18 months for new or materially changed controls.

Yes. The TX DIR Catalog 2.2 is supported in OneClickComply today. You can track all 19 families, collect evidence automatically from connected tools, generate policies and reuse work already done for NIST SP 800-53, TX-RAMP or ISO 27001. Our audit team can help you interpret the State Implementation Details for your environment.