A Software Company in Austin, Reading TX-RAMP Before the State Asks

Updated November 2026 · Written and maintained by the Progression Agency strategy team

A procurement officer at a Texas agency asks a vendor one question before anything else: is this a cloud computing service, and if so, what is its TX-RAMP status? A software company in Austin is close to the people who ask, with state agencies a short walk from the Capitol, but being close does not answer the question. This page sets out the two questions a vendor has to answer and the four routes that follow, then what the work costs. Progression is based in New York, builds for Austin companies remotely, and offers on-site sessions on request.

Is this a cloud service?

The intake form at a state agency has a line for the product name and then two questions that vendors tend to answer last. A salesperson fills in the first line in a minute. The blanks wait for an engineer.

The form above is an illustration. The reason to start here is practical: a state agency cannot buy a covered service without the answer, and a deal that stalls on a blank field stalls for weeks. Everything below helps a software team fill both blanks before the form arrives.

What a software company in Austin needs to say about TX-RAMP

The TX-RAMP eligibility page from the Texas Department of Information Resources says the program’s requirements apply to state agencies, institutions of higher education and public community colleges. Agencies must contract for cloud services with appropriate certification, and cloud providers demonstrate compliance with the security criteria to receive and maintain a certification.

An Austin software company that sells only to private buyers, such as retailers, is not covered by the program’s requirements on that basis alone. One that sells a cloud service to a university or a state agency is, and the scope question turns on the definition of a cloud computing service in Texas Government Code section 2054.0593(a).

A notice on the program’s pages says House Bill 150 of the 89th Legislature transferred the Department’s cybersecurity functions to the Texas Cyber Command. The TX-RAMP pages are still on the Department’s site, so use them for the program itself and ask the TX-RAMP team who handles a given request.

Does the program cover every product a vendor sells?

No. The Department says only cloud computing services are within scope, and that products or services that are not cloud computing services are not subject to TX-RAMP. Certain specific cloud offerings fall outside the Government Code section too, and the Department points to its Program Manual for details.

Where does a vendor start?

The program’s home page offers a short form for vendors to find out whether a cloud service is in scope and requires certification. Use it, and save the response, which is emailed to you.

Two questions

Every route starts the same way. First, is the service a cloud computing service as the definition reads? Second, what data does it handle? The answers decide the level, and the level decides what a vendor has to show.

Ask the agency before deciding. A buyer knows how it classifies its own data, and a vendor that writes down the buyer’s answer has something to show an assessor. Do not guess a level to be safe, because the wrong level costs time in either direction.

• Write both answers on one page and date it.
• Put the agency’s words about its data in the same file.
• Recheck the answers whenever the service adds a new kind of data.
• Do not describe a product as certified until the program lists it.

Four routes

The eligibility page describes two levels and a provisional step, and it names existing authorizations that can stand in for a level’s criteria. Put together, a vendor has four routes.

Level 1 for public or non-confidential data

The Department describes Level 1 for public or non-confidential information or low impact systems. It is achieved by submitting assessment responses that meet the minimum requirements for the Level 1 criteria, or by submitting evidence of StateRAMP Category 1 or FedRAMP Low authorization.

Level 2 for confidential or regulated data

Level 2 is for confidential or regulated data in moderate or high impact systems. It is achieved by meeting the minimum requirements for the Level 2 criteria, or by evidence of StateRAMP Category 2 or FedRAMP Moderate authorization.

Using an existing authorization

A service that already holds one of the named authorizations can offer that evidence for the matching level, as the Department’s page describes. A vendor with a federal customer may already be partway there, so check the current page before starting a new assessment.

The 18 month provisional window

Provisional status permits a state agency to contract for the use of a product for up to 18 months without full TX-RAMP certification. The cloud service then has to be certified through an assessment or equivalent within that period. It is a step in the request process, reached by completing the Acknowledgment and Inventory Questionnaire after submitting the online request form.

The program page also lists Fast Track requests among the request types. Ask the TX-RAMP team whether a service qualifies, and what it needs to bring.

What it costs to get there

The software work behind a certification effort depends on what already exists. A product with roles, logging and a clean architecture diagram needs little change. One built quickly for a pilot may need real rework before an assessor can follow it.

Bands for the software work

An Austin software development company prices the build, not the certification. We list no certification fee, and the program’s own page is the place to ask about assessment steps. The bands run from the typical low to the published high.

Hosting, licenses and security testing are on top of those figures. Progression quotes after a written scope. Our software development company page lists the work we take on, and app development in Austin and app development in Texas cover the app side.

The documents an assessor asks for

Assessors read evidence, not intentions. A software team should expect to hand over a description of the service, a diagram of where data lives, the access rules, the logging setup and the policies that govern changes.

Existing audit reports, such as a SOC 2 Type II report or an ISO 27001 certificate, belong in the folder too. Ask the TX-RAMP team whether a report can support a request, including a Fast Track request, before spending time to repackage it.

What a software team produces

A one page service description, an architecture and data flow diagram, a list of roles with what each can do, a sample of the logs, the change process and the incident steps. Most of these double as documentation the team needs anyway.

Where the control list lives

The Department publishes the specific technical criteria for the two levels as the TX-RAMP Security Control Baselines spreadsheet on the program page. Ask a security assessor which controls apply to your service, and let the spreadsheet, not this page, drive the work.

• Gather existing audit reports and policies into one folder.
• Date every diagram and keep old versions.
• Name one person who answers the assessor’s questions.
• Keep screenshots of settings, not only descriptions of them.

Software company in Austin, Texas: building it right the first time

Security that is added after launch costs more than security designed in. Access control, logging and encryption are the kind of work that is cheap to plan on day one and expensive to retrofit when a customer’s questionnaire arrives.

The cards describe habits, not a list of controls the program requires. We promise no control counts and no outcome. A good build makes the assessor’s questions easy to answer.

Can an existing product be retrofitted?

Usually, though the cost depends on how tangled the code is. Start with the data map and the roles. They show which parts of the product touch the most sensitive data and where the gaps sit.

Does cloud hosting settle the question?

No. A hosting provider’s own assurances cover its part of the stack. The vendor still answers for its software, its settings and its people.

A brief for a state agency software project

Copy this card into a document and fill it in before a pitch to an agency or a university. A vendor that completes it can brief a software team in an afternoon.

Send the finished card with a link to the product. Our software development company page describes the build that follows.

Who in the company answers which question?

A TX-RAMP request pulls in people who rarely sit in the same meeting. Decide up front who owns each answer, so the agency hears one voice and the assessor never waits on an email thread.

• Name one person as the program contact and write down a backup.
• Keep every answer in a shared folder with the date it was given.
• Route all agency emails to a shared inbox, not one person.
• Review the folder before every renewal or contract change.
• Tell sales which answers are final and which are drafts.

What can wait until after the first contract?

A first state sale rarely needs everything at once. Some work belongs before the request, some belongs inside the provisional window, and some can follow the first contract.

• Before the request: the service description, the data map and the role list.
• During a provisional window: the assessment work and the evidence folder.
• After the first contract: automation of evidence collection and a yearly review.
• At any time: a quiet fix list for gaps the data map exposes.
• Throughout: the dated record of what was decided and why.

The provisional window is up to 18 months, and the service must be certified through an assessment or equivalent within it. Treat the window as a deadline for the evidence work, not a grace period.

What should a first meeting with an assessor cover?

Keep it practical. Bring the service description, the data map and the role list, and ask what else the assessor will want to see before any work begins.

• Bring the three core documents on paper or on a screen.
• Ask what format the assessor prefers for evidence.
• Ask how long the assessor needs once the evidence is in.
• Write down every question you cannot answer on the spot.
• Send a thank you note that restates what was agreed.
• Put the next meeting on the calendar before leaving the room.

Related services and guides

Pages that sit beside this picker:

• Software development company
• App development agency
• App development company in Austin
• App development company in Texas
• Marketing agency in Austin

Frequently asked questions