TX-RAMP Level 1Supported in OneClickComply

Get your cloud service TX-RAMP Level 1 certified with less effort

TX-RAMP Level 1 is the Texas Risk and Authorization Management Program certification for cloud services that process non-confidential information or support low-impact systems for Texas state agencies. It is run by the Texas Department of Information Resources (DIR) under Texas Government Code Section 2054.0593 and assesses vendors against 117 security controls drawn from NIST SP 800-53. Level 2 is the separate, larger baseline for confidential data.

See the TX-RAMP Level 1 requirements

TX-RAMP Level 1 Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs TX-RAMP Level 1

Is TX-RAMP Level 1 right for your organisation?

Any vendor providing a cloud service to a Texas state agency or public university needs TX-RAMP certification before the agency can enter or renew the contract. Level 1 applies when the contracting agency classifies the service as low impact, for example where it handles only public or non-confidential data. Vendors usually start the process when a Texas public sector deal or renewal is in the pipeline.

It is a legal or regulatory requirement for organisations in scope.

Issued by: Texas Department of Information Resources (DIR)
Legal basis: Texas Government Code Section 2054.0593, added by Senate Bill 475 (2021)
Applies to: Cloud services for Texas state agencies that handle non-confidential data or low-impact systems
Control baseline: 117 controls drawn from NIST SP 800-53
Certification validity: Three years, subject to continuous monitoring
Accepted alternatives: Evidence of an approved federal or state authorisation, such as FedRAMP or GovRAMP, can be submitted to DIR
Type: Certification (mandatory)
Region: Texas, US
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

TX-RAMP Level 1 is mapped in OneClickComply's control library and available on request, so you can work against the 117 Level 1 controls alongside frameworks you already hold, such as SOC 2 or ISO 27001. Automated evidence collection, AutoComplete policies and continuous monitoring help you build and keep the documentation DIR reviews, and our in-house audit team can answer questions through Ask an Auditor.

Requirements covered

117 controls across 17 NIST SP 800-53 control families, from Access Control to System and Information Integrity, forming the TX-RAMP Level 1 baseline.

Already working towards another framework?

ISO 2700124% of TX-RAMP Level 1 overlaps
SOC 277% of TX-RAMP Level 1 overlaps
NIST CSF61% of TX-RAMP Level 1 overlaps
GDPR21% of TX-RAMP Level 1 overlaps

Evidence you collect once counts towards every framework it applies to.

Manual TX-RAMP Level 1 vs. OneClickComply

Manual TX-RAMP Level 1

Working out which of the 117 Level 1 controls you already meet through other frameworks
Writing a separate policy and procedure document for each of 17 control families
Gathering screenshots and exports from every cloud and identity tool by hand
Losing track of control drift between submissions and ongoing monitoring requests
Re-answering the same security questions for each Texas agency and university buyer

With OneClickComply

Control mapping shows where SOC 2 or ISO 27001 evidence already counts towards Level 1
AutoComplete generates audit-ready policies from your real environment
Evidence is collected automatically from 13,000+ integrations and the Companion AI browser agent
Continuous monitoring alerts you when a control drifts so it can be fixed before DIR asks
Security questionnaire automation and a trust centre reuse your answers for every buyer

Capabilities

Everything you need for TX-RAMP Level 1

Control mapping of your existing controls to the 117 TX-RAMP Level 1 controls

Automated evidence collection for access, logging, configuration and backup controls

AutoComplete policies covering the policy and procedure control in each family

Continuous monitoring with alerts when Level 1 controls drift between assessments

OneClickFix for supported misconfigurations, with each change logged as evidence

Vendor risk management and trust centre to share your TX-RAMP status with Texas buyers

How it works

Three steps to TX-RAMP Level 1 compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against TX-RAMP Level 1 and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates TX-RAMP Level 1-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

TX-RAMP Level 1 requirements

The 117 controls in the TX-RAMP Level 1 baseline, listed by NIST SP 800-53 Rev. 5 identifier and title across 17 control families.

Reference	Requirement
AC-1	Access Control Policy and Procedures
AC-2	Account Management
AC-3	Access Enforcement
AC-7	Unsuccessful Logon Attempts
AC-14	Permitted Actions Without Identification or Authentication
AC-17	Remote Access
AC-18	Wireless Access
AC-19	Access Control for Mobile Devices
AC-20	Use of External Systems
AT-1	Awareness and Training Policy and Procedures
AT-2	Literacy Training and Awareness
AT-3	Role-based Training
AT-4	Training Records
AU-1	Audit and Accountability Policy and Procedures
AU-2	Event Logging
AU-3	Content of Audit Records
AU-4	Audit Log Storage Capacity
AU-5	Response to Audit Logging Process Failures
AU-6	Audit Record Review, Analysis, and Reporting
AU-8	Time Stamps
AU-9	Protection of Audit Information
AU-11	Audit Record Retention
AU-12	Audit Record Generation
CA-1	Assessment, Authorization, and Monitoring Policy and Procedures
CA-2	Control Assessments
CA-3	Information Exchange
CA-5	Plan of Action and Milestones
CA-6	Authorization
CA-7	Continuous Monitoring
CA-7(4)	Continuous Monitoring: Risk Monitoring
CA-9	Internal System Connections
CM-1	Configuration Management Policy and Procedures
CM-2	Baseline Configuration
CM-4	Impact Analyses
CM-5	Access Restrictions for Change
CM-6	Configuration Settings
CM-7	Least Functionality
CM-8	System Component Inventory
CM-10	Software Usage Restrictions
CM-11	User-installed Software
CP-1	Contingency Planning Policy and Procedures
CP-2	Contingency Plan
CP-3	Contingency Training
CP-4	Contingency Plan Testing
CP-9	System Backup
CP-10	System Recovery and Reconstitution
IA-1	Identification and Authentication Policy and Procedures
IA-2	Identification and Authentication (Organizational Users)
IA-2(1)	Multi-factor Authentication to Privileged Accounts
IA-4	Identifier Management
IA-5	Authenticator Management
IA-5(1)	Password-based Authentication
IA-6	Authentication Feedback
IA-7	Cryptographic Module Authentication
IA-8	Identification and Authentication (Non-organizational Users)
IA-11	Re-authentication
IR-1	Incident Response Policy and Procedures
IR-2	Incident Response Training
IR-4	Incident Handling
IR-5	Incident Monitoring
IR-6	Incident Reporting
IR-7	Incident Response Assistance
IR-8	Incident Response Plan
MA-1	Maintenance Policy and Procedures
MA-2	Controlled Maintenance
MA-4	Nonlocal Maintenance
MA-5	Maintenance Personnel
MP-1	Media Protection Policy and Procedures
MP-2	Media Access
MP-6	Media Sanitization
MP-7	Media Use
PE-1	Physical and Environmental Protection Policy and Procedures
PE-2	Physical Access Authorizations
PE-3	Physical Access Control
PE-6	Monitoring Physical Access
PE-8	Visitor Access Records
PE-13	Fire Protection
PE-14	Environmental Controls
PE-15	Water Damage Protection
PE-16	Delivery and Removal
PL-1	Planning Policy and Procedures
PL-2	System Security and Privacy Plans
PL-4	Rules of Behavior
PS-1	Personnel Security Policy and Procedures
PS-2	Position Risk Designation
PS-3	Personnel Screening
PS-4	Personnel Termination
PS-5	Personnel Transfer
PS-6	Access Agreements
PS-7	External Personnel Security
PS-8	Personnel Sanctions
RA-1	Risk Assessment Policy and Procedures
RA-2	Security Categorization
RA-3	Risk Assessment
RA-5	Vulnerability Monitoring and Scanning
RA-5(2)	Update Vulnerabilities to Be Scanned
RA-7	Risk Response
SA-1	System and Services Acquisition Policy and Procedures
SA-3	System Development Life Cycle
SA-4	Acquisition Process
SA-5	System Documentation
SA-9	External System Services
SA-22	Unsupported System Components
SC-1	System and Communications Protection Policy and Procedures
SC-5	Denial-of-service Protection
SC-7	Boundary Protection
SC-12	Cryptographic Key Establishment and Management
SC-20	Secure Name/Address Resolution Service (Authoritative Source)
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)
SC-22	Architecture and Provisioning for Name/Address Resolution Service
SC-39	Process Isolation
SI-1	System and Information Integrity Policy and Procedures
SI-2	Flaw Remediation
SI-3	Malicious Code Protection
SI-4	System Monitoring
SI-5	Security Alerts, Advisories, and Directives
SI-12	Information Management and Retention

Always check the official TX-RAMP Level 1 text for the exact wording.

TX-RAMP Level 1 FAQs

What is TX-RAMP Level 1?

TX-RAMP Level 1 is the Texas certification for cloud services that handle non-confidential data or support low-impact information systems for state agencies. The Texas Department of Information Resources runs it under Texas Government Code Section 2054.0593. Vendors are assessed against 117 security controls drawn from NIST SP 800-53, a smaller baseline than Level 2, which covers confidential data and moderate or high impact systems.

Who needs TX-RAMP Level 1 certification?

Cloud service providers need TX-RAMP Level 1 when a Texas state agency or public institution of higher education wants to buy a cloud service it classifies as low impact. Under state law, an agency cannot enter or renew a contract for an in-scope cloud service unless the vendor demonstrates TX-RAMP compliance, and the vendor must stay certified for the whole contract term.

What is the difference between TX-RAMP Level 1 and Level 2?

The difference is the sensitivity of the data and the size of the control baseline. Level 1 covers cloud services handling non-confidential data or low-impact systems and uses 117 controls. Level 2 covers services handling confidential data or moderate and high impact systems and uses a much larger baseline. The contracting agency decides which level applies to a given service.

What happens if a vendor is not TX-RAMP certified?

Without TX-RAMP certification, a Texas state agency cannot sign or renew a contract for an in-scope cloud service with that vendor. The consequence is lost or delayed public sector business rather than a fine. Agencies must also require vendors to keep their certification for the full term of the contract, so a lapse can put existing Texas contracts at risk.

How do you get TX-RAMP Level 1 certified?

You get TX-RAMP Level 1 certified by submitting an assessment request to DIR, completing the required security questionnaire and documentation for the 117 Level 1 controls, and passing DIR's review. Vendors that already hold an approved federal or state authorisation, such as FedRAMP or GovRAMP, can submit that evidence instead. Certified services appear on DIR's published list of certified cloud products.

How long does TX-RAMP Level 1 certification last?

TX-RAMP Level 1 certification is generally valid for three years, as long as the cloud service continues to meet program requirements. During that time vendors are subject to continuous monitoring, which includes responding to DIR requests and reporting significant changes or security incidents. Check the current TX-RAMP Program Manual on the DIR website for the exact monitoring schedule and renewal steps.

How does TX-RAMP Level 1 relate to FedRAMP, GovRAMP and SOC 2?

TX-RAMP Level 1 is built on NIST SP 800-53, the same catalogue behind FedRAMP and GovRAMP, and DIR accepts approved federal or state authorisations as evidence of compliance. SOC 2 and ISO 27001 are not direct substitutes, but much of the evidence you collect for them, such as access reviews, logging and incident response, also supports the Level 1 controls.

Does OneClickComply support TX-RAMP Level 1?

Yes, on request. TX-RAMP Level 1 is mapped in OneClickComply's control library and available on request, rather than live as a standard framework today. Once enabled, you can map your existing controls to the 117 Level 1 controls, collect evidence automatically and generate policies. OneClickComply does not issue TX-RAMP certification; DIR reviews your submission and grants it.

Related standards

All standards

Get TX-RAMP Level 1 ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.