GovTech SaaS selling to states and localities
Your product serves permitting, public safety, health, education or finance, and state buyers keep sending security reviews. One recognized status can replace a pile of questionnaires.
Government & defense
GovRAMP (formerly StateRAMP) & TX-RAMP readiness
A state agency, a county or a Texas university wants your cloud service, and procurement has asked for your GovRAMP status or TX-RAMP certification before the contract moves. Readiness shows you which program and level your buyer actually needs, closes the gaps against the NIST SP 800-53 controls behind it and prepares the evidence an approved 3PAO or Texas DIR will review — so the security review stops being the thing that holds up the deal.
Formal outcome from
GovRAMP, after assessment by a GovRAMP-approved 3PAO; Texas DIR for TX-RAMP certification
Who asks for it
State agency procurement and CISOs · Texas state agencies and public universities
Our role
Readiness — we prepare you; your assessor decides
Your organization — readiness viewEvery requirement, an owner and its evidence
Readiness- SCOPEScope and system boundaryReady
- RISKRisk assessment and registerReady
- ACCESSAccess reviews, with evidenceGap · owner set
- CHANGEChange managementClosing
- VENDORVendor managementGap · owner set
- TESTPenetration test evidenceReport in hand
Handed to the assessor you choose — the opinion is theirs
Gaps found before the audit
Who it’s for
Why GovRAMP & TX-RAMP lands on your desk.
GovRAMP — the program formerly known as StateRAMP — gives state and local governments a common way to verify the security of the cloud services they buy, instead of every agency running its own questionnaire. It is built on NIST SP 800-53 Rev 5, with baselines aligned to FedRAMP’s. Providers register with GovRAMP, a GovRAMP-approved 3PAO assesses the service, and GovRAMP reviews the results and publishes a status on its authorized product list. Providers that aren’t ready for full assessment can start with a scored Security Snapshot. Once a state, city or school district writes GovRAMP into procurement, every cloud vendor selling there gets asked for it.
TX-RAMP is the Texas Department of Information Resources program for cloud computing services used by Texas state agencies, required by Texas Government Code section 2054.0593, and it reaches the state’s public universities as well. Certification is granted by Texas DIR at Level 1 for services that hold non-confidential, low-impact information or Level 2 for services that hold confidential or regulated data. DIR can grant certification based on its own review of your security assessment, or recognize an existing FedRAMP or GovRAMP authorization.
Teams come to readiness because the two programs overlap but aren’t interchangeable, and because state buyers don’t accept “we have a SOC 2” as an answer once they’ve adopted one of them. Readiness picks the right program and level for the buyers you’re pursuing and builds the control set once so it serves both. CyberlySecure is based in Houston, so Texas is home turf: the agencies and universities asking for TX-RAMP are our neighbors, and we can sit down with your team wherever in the state it works.
Who asks for it
State agency procurement and CISOsTexas state agencies and public universitiesCounties, cities and school districtsIntegrators and resellers on state contractsPublic-sector buyers who accept GovRAMP in place of their own review
Vendors with a Texas contract on the line
A Texas agency or university can’t sign, renew or extend your cloud service without TX-RAMP. You need to know your level and what DIR will look for.
Providers already FedRAMP authorized or in process
You’ve done the federal work and want to reuse it. You need to know what GovRAMP and TX-RAMP accept from your existing package and what they still ask of you.
Smaller providers starting out
Full assessment feels far off, but buyers want proof of progress. A Security Snapshot or a TX-RAMP Level 1 certification can be the right first milestone, built on controls that keep scaling.
Who certifies
We prepare you. Your assessor decides.
Formal outcome from
GovRAMP, after assessment by a GovRAMP-approved 3PAO; Texas DIR for TX-RAMP certification
What they produce
A GovRAMP status on the GovRAMP authorized product list, and a TX-RAMP Level 1 or Level 2 certification
Where readiness fits
Readiness prepares your service and your evidence for those reviews. The 3PAO assesses, GovRAMP and Texas DIR decide, and the firm that prepared you stays on your side of the table throughout.
NIST SP 800-53 Rev 5 NIST SP 800-53A Rev 5 GovRAMP security baselines and Security Snapshot criteria Texas Government Code §2054.0593 (TX-RAMP) TX-RAMP Program Manual (Texas DIR) Texas Administrative Code Title 1, Chapter 202 FIPS 199 FIPS 140-3 FedRAMP Rev 5 baselines
What it covers
What GovRAMP & TX-RAMP readiness covers.
- Program and level selection: the GovRAMP baseline, TX-RAMP Level 1 or Level 2, and what each buyer’s procurement actually requires
- Classification of the state data you’ll hold, which drives the impact level and the TX-RAMP level
- Authorization boundary and data flow diagrams for the cloud service
- Gap assessment against the NIST SP 800-53 Rev 5 baseline GovRAMP uses
- TX-RAMP control requirements and the vendor security assessment Texas DIR reviews
- Security Snapshot preparation for providers that want a scored starting point before full assessment
- Reuse of an existing FedRAMP package, GovRAMP status or SOC 2 and ISO 27001 evidence where the programs allow it
- System Security Plan, policies and procedures mapped to the controls the 3PAO tests
- Encryption, multifactor authentication and centralized audit logging
- Vulnerability management and a POA&M for open findings
- Incident response that meets the notification duties in your state contracts
- Subprocessor and supply chain review for every service inside the boundary
- Data location, personnel and access commitments state contracts commonly include
- Continuous monitoring that keeps your status current after award
What you receive
What you have in hand when readiness is done.
Program and level recommendation
A written answer on which program, baseline and TX-RAMP level fit the buyers you’re pursuing, tied to the data your service will hold.
Boundary and data flow diagrams
Diagrams of your service’s components, data flows and external connections, ready to support an SSP and a 3PAO assessment.
Control gap assessment
Each control in the applicable baseline marked implemented, partially implemented or missing, with the evidence and the work needed to close it.
Reciprocity crosswalk
A map of the FedRAMP, SOC 2 or ISO 27001 evidence you already have against GovRAMP and TX-RAMP requirements, so nothing is built twice.
System Security Plan and policies
An SSP and the policies and procedures behind it, written to describe how your service actually meets each control.
Plan of Action and Milestones
Every open gap with an owner, a remediation approach and milestones, prioritized by risk to the state data you hold.
TX-RAMP evidence pack
The answers and supporting evidence for the TX-RAMP security assessment, organized so DIR’s reviewers can follow each claim to its proof.
Continuous monitoring plan
How you will keep scanning, POA&M updates and change notifications current so your status stays valid and buyers keep trusting it.
Common gaps
What a GovRAMP & TX-RAMP readiness review tends to surface.
Better found now, by people on your side, than by your assessor.
Assuming a SOC 2 report will satisfy a state buyer that has adopted GovRAMP or TX-RAMP
Data classification never agreed with the agency, so nobody knows whether TX-RAMP Level 1 or Level 2 applies
Subprocessors and third-party services inside the boundary with no security review of their own
Encryption that isn’t FIPS-validated, or multifactor authentication missing for administrative access
Policies that exist but aren’t mapped to the NIST SP 800-53 controls the assessor tests
Questionnaire answers that overstate controls and don’t match the evidence behind them
Incident notification commitments in state contracts that the incident response plan doesn’t reflect
No continuous monitoring process to keep status current after the contract is signed
Where testing fits
The tests GovRAMP & TX-RAMP calls for, from the same team.
SaaS application pentest
NIST SP 800-53 control CA-8 calls for penetration testing at the higher baselines, and state buyers routinely ask for a recent test of the service itself, including tenant isolation.
What the test coversWeb application pentest
Public-facing portals for residents and staff are the most exposed part of most state cloud services and the first thing a 3PAO or agency reviewer probes.
What the test coversAPI & web services pentest
Integrations with state systems move sensitive data through APIs; testing them checks authentication and authorization where that data crosses the boundary.
What the test coversExternal network pentest
Your internet-facing infrastructure is in scope for every baseline; an external test produces boundary protection evidence and findings to close before assessment.
What the test coversCloud configuration review
Most state cloud services run on a public cloud platform, and a configuration review checks the settings you own against the controls you claim.
What the test coversVulnerability assessment
Control RA-5 requires vulnerability scanning, and continuous monitoring depends on scan results that cover the whole inventory and feed the POA&M.
What the test covers Questions
What buyers ask about GovRAMP & TX-RAMP.
Is GovRAMP the same thing as StateRAMP?
Yes. StateRAMP rebranded as GovRAMP to reflect that it serves government at every level, not only states. The program’s purpose and its NIST SP 800-53 foundation are the same, and existing StateRAMP statuses carry forward under the GovRAMP name. If a contract or RFP still says StateRAMP, it means GovRAMP.
Do we need TX-RAMP if we already have FedRAMP or GovRAMP?
If you sell cloud services to Texas state agencies or public universities, you still need a TX-RAMP certification — but Texas DIR can grant it by recognizing an existing FedRAMP or GovRAMP authorization rather than through a full review of its own. Readiness confirms whether your existing authorization covers the service and level your Texas buyer needs.
What’s the difference between TX-RAMP Level 1 and Level 2?
Level 1 is for cloud services that handle publicly available or non-confidential, low-impact information. Level 2 is for services that store or process confidential or regulated data, or that support critical agency functions, and carries a broader set of required controls. The agency’s classification of the data decides, which is why readiness starts by agreeing that classification with your buyer.
Can CyberlySecure assess us or grant our status?
No. GovRAMP assessments are performed by GovRAMP-approved 3PAOs, GovRAMP itself publishes the status, and TX-RAMP certifications are granted only by Texas DIR. CyberlySecure is none of those. We prepare you for them, which keeps the firm that helps you separate from the parties that judge the result.
Does GovRAMP cover cities, counties and education?
Yes. GovRAMP’s government members include states, local governments and education institutions, and any of them can require a GovRAMP status in procurement. A single status lets you answer them all with the same evidence instead of a different questionnaire for each buyer.
Why work with a Houston firm on this?
Because Texas is home turf. CyberlySecure is based in Houston, TX-RAMP is a Texas program, and many of the buyers asking for it are a drive away. We can sit down with your team in person, and we pair readiness with the penetration testing your buyers ask for, so the evidence you submit comes from one consistent picture of your service.
Is GovRAMP & TX-RAMP on your desk?
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.