Compliance Framework
TX-RAMP
Achieve Texas Risk and Authorization Management Program certification for state agency data.
The Texas Risk and Authorization Management Program (TX-RAMP) provides a standardized approach to security assessment, certification, and continuous monitoring for cloud computing services that process the data of Texas state agencies. It defines two certification levels based on data impact, and - like FedRAMP, on which it draws - recognizes existing authorizations to streamline the path for providers that have already done the work elsewhere.
HanaByte helps providers determine the right TX-RAMP level, leverage any existing FedRAMP or StateRAMP/GovRAMP authorization, and assemble the assessment evidence and monitoring needed to certify and stay compliant.
How we help
TX-RAMP Workshops
Scope
- Interactive workshops on TX-RAMP processes and requirements, educating key stakeholders, technical personnel, and support teams. Sessions are used to learn more about your business.
Deliverables
- Delivery of workshops covering TX-RAMP requirements and authorization paths.
- Regular remote meetings to track progress on a schedule that fits your team.
Personnel & timeline
- Security consultant(s) assigned to the engagement for a flat fee.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
- Provide access to relevant personnel for workshop sessions.
TX-RAMP Advisory Services
Scope
- Guidance assessing your existing control implementations, infrastructure, policies, procedures, and documentation against TX-RAMP requirements.
- Ongoing guidance through TX-RAMP requirements and which priorities to address first.
Deliverables
- Regular meetings to consult on TX-RAMP processes and close compliance gaps.
Personnel & timeline
- Security consultant(s), billed hourly as needed for the engagement.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
TX-RAMP Gap Assessment
Scope
- Assessment of your existing controls, infrastructure, policies, procedures, and documentation to perform a gap analysis against TX-RAMP requirements.
- Creation of a report with a detailed roadmap of remediation efforts across people, process, and technology for all unmet requirements.
Deliverables
- Detailed readiness assessment covering your environment, policies, procedures, personnel, and controls.
- Remediation plan with prioritized steps and regular meetings to track progress.
Personnel & timeline
- Security consultant(s) assigned to the engagement; expected turnaround of 4 to 6 weeks depending on scope.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
TX-RAMP Launch
Scope
- Assessment of your existing controls, infrastructure, and documentation to perform a gap analysis against TX-RAMP requirements.
- Workshops on TX-RAMP processes and implementation strategies for your stakeholders and technical teams.
- Creation of a report with a detailed remediation roadmap across people, process, and technology.
Deliverables
- Detailed readiness assessment of your environment, policies, procedures, personnel, and controls.
- Delivery of workshops covering TX-RAMP requirements.
- Remediation plan with prioritized steps and regular meetings to track progress.
Personnel & timeline
- Security consultant(s) assigned to the engagement; typical timeline of 12 to 16 weeks depending on scope.
Customer responsibilities
- Provide access to related documentation and in-scope systems.
Frequently asked questions
What is TX-RAMP?
The Texas Risk and Authorization Management Program provides standardized security assessment, certification, and continuous monitoring for cloud services that process Texas state agency data.
What are the TX-RAMP levels?
TX-RAMP defines two certification levels based on the impact of the data involved; the right level depends on what the cloud product handles.
Can existing authorizations help with TX-RAMP?
Yes - TX-RAMP recognizes certain existing authorizations (such as FedRAMP), which can streamline the path to certification.