Get TX-RAMP Level 2 ready without chasing evidence by hand

TX-RAMP Level 2 is the Texas Risk and Authorization Management Program certification for cloud computing services that process, store or transmit confidential state agency data in moderate or high impact systems. It is the higher of the two TX-RAMP baselines and assesses 223 NIST SP 800-53 based controls and enhancements across 17 control families. Certified services must keep complying, including quarterly vulnerability reporting, for the three year certification period.

Level 1 covers cloud services handling nonconfidential data or low impact systems, while Level 2 covers confidential data in moderate or high impact systems. Level 1 assesses 117 controls and enhancements and Level 2 assesses 223. Level 2 also requires quarterly vulnerability reports rather than annual ones, and it has been required for new or renewed contracts since 1 January 2022, compared with 1 January 2024 for Level 1.

Cloud service providers need TX-RAMP Level 2 when a Texas state agency, university or public community college buys their IaaS, PaaS or SaaS product to handle confidential data at moderate or high impact. Confidential data includes items such as sensitive personal information, driver's licence numbers and regulated data. The contracting agency decides the required level, and SaaS products on certified infrastructure still need their own certification.

A Texas state agency cannot enter into or renew a contract for an in-scope cloud service unless the vendor shows compliance with TX-RAMP. There are no published fines; the consequence is losing access to state contracts. DIR can also revoke certification, for example for missing continuous monitoring reports, failing to report significant changes within 30 days, or not reporting a security breach within 48 hours.

You get TX-RAMP Level 2 by submitting a TX-RAMP request, then completing the Acknowledgment and Inventory Questionnaire and the Level 2 Assessment Questionnaire for DIR review. Alternatively, a FedRAMP Moderate or High authorization or a matching StateRAMP (now GovRAMP) authorization can be accepted through reciprocity. Providers with accepted audit reports such as SOC 2 Type 2 or ISO 27001 may qualify for a tailored Fast Track assessment.

TX-RAMP Level 2 certification is valid for three years from the date it is granted, provided the service keeps meeting program requirements. DIR aims to complete a review within four weeks once it begins, but total time depends on documentation quality, how quickly you respond and the queue. A provisional certification lasting 18 months lets agencies contract with you while full certification is completed.

TX-RAMP Level 2 is built on NIST SP 800-53, like FedRAMP and GovRAMP, and a FedRAMP Moderate or StateRAMP (GovRAMP) Moderate authorization can be accepted for Level 2 through reciprocity. SOC 2 Type 2 and ISO 27001 do not grant certification on their own, but they are accepted artifacts for the Fast Track route, which can reduce the documentation you need to provide.

Yes. TX-RAMP Level 2 is supported in OneClickComply today. You can track all 17 control families, reuse evidence from frameworks such as SOC 2 and ISO 27001, generate policies and monitor controls continuously. OneClickComply does not issue TX-RAMP certification; DIR, transferring to the Texas Cyber Command, grants it.