Skip to content
AnglinAI Docs

TX-RAMP Certification Path for Gevell PDF

Question: UTHealth Houston is sending a $5,000 PO for Gevell PDF, and we’re also pursuing UT Southwestern. Do we need TX-RAMP (Texas Risk and Authorization Management Program), which level, and should we start now?

Short answer: Very likely yes. The dollar amount doesn’t matter, and both UTHealth and UTSW count as “state agencies” under TX-RAMP. The level is the customer’s call. If they upload confidential/FERPA documents, expect Level 2. If the use is limited to public documents (such as public web PDFs being fixed for ADA Title II), Level 1 is plausible, or even “not subject”. Recommendation: request TX-RAMP Provisional certification now. It’s free, the vendor starts it, it needs no audit, and it covers every Texas public university and state agency for 12 months. Then work toward full certification through DIR’s free self-assessment. Confirm scope and level with Victoria Adjei first (questions in §6).

Everything below comes from official sources as of 2026-09-23. The main source is the TX-RAMP Program Manual v4.0, effective 2026-02-12 (PDF). Items marked [UNCERTAIN] need confirmation.

1. Does TX-RAMP apply to this purchase?

Who must require it

  • Gov’t Code §2063.408 (formerly §2054.0593, created by SB 475 in 2021) says a state agency may “only enter or renew contracts to receive cloud computing services that comply with TX-RAMP requirements.” (Manual v4.0 §3)
  • “State agency” follows Gov’t Code §2054.003(13), which includes universities and institutions of higher education (Education Code §61.003). DIR’s FAQ and eligibility pages say so explicitly. UTHealth Houston and UT Southwestern both qualify. (FAQ, Eligibility)
  • UT System’s vendor minimum security requirements also require TX-RAMP for cloud-based services under SB 475. (UT System)
  • UTSW’s own page says that when TX-RAMP applies, “the vendor must certify their cloud service or UTSW cannot enter a contract.” (UTSW TX-RAMP)

Is Gevell PDF a “cloud computing service”?

Yes. It’s multi-tenant, browser-accessed, self-service SaaS, which meets the NIST SP 800-145 characteristics in Manual §5.1. Each product is certified separately (Manual §3). Certifying Gevell PDF would not cover Gevell Audit, Forms, and so on.

Exemptions: what exists and what doesn’t

Possible exemptionStatus
Purchase amount / small PONone. Neither the statute nor the manual has a dollar threshold. A $5,000 PO is covered the same as a $500k one.
Pilot / free trial / limited useNone stated in the statute or manual. [UNCERTAIN] Some institutions treat no-cost pilots differently internally. Ask.
Non-substantive use of confidential data (Manual §6.1)Yes, the main lever. The agency can decide a service is not subject to TX-RAMP if it’s a low-impact resource that stores no confidential state data beyond what login needs, or only a “negligible quantity and/or quality” of confidential data with no expected adverse effect. The agency makes and documents this call, not DIR and not us. UTSW’s page repeats this exemption.
Custom-developed apps (Manual §6.2)Doesn’t apply. We’re a commercial product, not built to their spec.
Research exemptionNot found in SB 475, the Program Manual, or the FAQ. [UNCERTAIN] I didn’t review the full Chapter 202 (moving to 1 TAC Ch. 477) rule text.

Even when a service is not subject to TX-RAMP, the agency still applies its own security requirements (Manual §6). UTHealth will still run its vendor risk review (HECVAT etc.) either way.

How “confidential” data sets the level

  • The agency decides the level (Manual §4.1, §8) using its own data classification, and may use DIR’s Baseline Scoping Tool.
  • Level 1 = low impact: loss would cause “limited adverse effect” (Manual §7.1).
  • Level 2 = moderate or high impact: “serious” or worse adverse effect (Manual §7.2). DIR’s eligibility page describes Level 2 as “confidential/regulated data.”
  • For Gevell: if UTHealth staff upload FERPA student records or confidential internal documents, most UT institutions classify that as Confidential and will require Level 2. If the contract limits use to documents that are already public (the typical ADA Title II remediation case: course materials and public web PDFs), the data is nonconfidential. That makes Level 1 defensible and possibly a §6.1 “not subject” determination. [UNCERTAIN: depends entirely on UTHealth’s classification.]

2. Certification types and levels

TypeWhat gets itControlsValidityOngoing obligations
ProvisionalDIR approval of the Acknowledgment & Inventory (A&I) questionnaire only. Can also come through FedRAMP In Process/Ready, a GovRAMP Snapshot, or GovRAMP Progressing Snapshot enrollment.None assessed. DIR says provisional “does not indicate compliance with TX-RAMP security baseline standards” (§10.1).12 months (v4.0 §3, §10) + discretionary extensions (§12)Must reach Level 1/2 before it expires. It lapses otherwise, and you can’t apply for a new provisional (§12.1).
Level 1 (low impact)A&I + Level 1 Assessment Questionnaire + Security Plan Workbook; or Fast Track; or FedRAMP Low. Not FedRAMP LI-SaaS (§9.2).117 NIST 800-53 Rev 5 controls/enhancements (App. A)3 years (§20)Annual vulnerability report through SPECTRIM (§17.2)
Level 2 (moderate/high)A&I + Level 2 Assessment Questionnaire + Workbook; or Fast Track; or FedRAMP Moderate/High; or any GovRAMP Core/Ready/Provisional/Authorized status223 controls/enhancements3 yearsQuarterly vulnerability reports (§17.2)

All certified services must also:

  • Report any breach to TX-RAMP within 48 hours (§17.3) and meet Tex. Bus. & Com. Code §521.053. Breaches affecting 250+ Texans also go to the Attorney General.
  • Report significant changes within 30 days (§17.4). Examples: new crypto modules, new information types, changed processing of PII, and infrastructure changes to the SaaS.
  • Keep POA&Ms (plans of action and milestones) for any deficient control and review them quarterly (§14.4).

Which fits Gevell? Level 2 if customers upload confidential/FERPA documents, which is the realistic assumption for a general PDF tool. Level 1 only if the customer contractually limits use to public documents. Plan for Level 2, and ask whether Level 1 is acceptable for the UTHealth use case.

Control counts per family (L1 / L2): AC 9/33 · AU 10/11 · AT 4/6 · CM 9/21 · CP 6/11 · IA 10/16 · IR 7/10 · MA 4/9 · MP 4/7 · PS 8/8 · PE 9/17 · PL 3/5 · RA 6/8 · CA 8/9 · SC 8/23 · SI 6/13 · SA 6/16 (Manual App. A). The baseline is NIST SP 800-53 Rev 5, not CJIS (Rev 5 alignment was added in v2.0). The full list is in the “TX-RAMP Baseline Controls 2.0.xlsx” workbook on the TX-RAMP Resources page.

3. Provisional certification: who, how, how long

  • Who starts it: the vendor. Manual §11 step 1: “CSPs seeking certification … must first complete the TX-RAMP Assessment Request form.” The form “should be completed by the actual developer,” so a SaaS lists itself, not AWS. No agency sponsor is required in v4.0 or on DIR’s request page. [UNCERTAIN] Early versions of the program and some campus pages (e.g., UT System’s “UT System may grant provisional certification temporarily”) describe agency-driven provisional paths. That appears to be legacy wording. Naming UTHealth as the prospective customer in the request is still wise.
  • Portal (current, 2026): DIR moved to the Archer platform. Vendors create an account and submit the Vendor Assessment Request through Archer Engage (request page; form: engage.archerirm.us/...; FAQ points to id.archerirm.cloud for account creation). Questionnaires and continuous monitoring run in SPECTRIM (dir.archerirm.us). Nothing was submitted and no account was created during this research.
  • Steps (Manual §11):
    1. Submit the request form (account required).
    2. DIR vets it and creates an engagement record.
    3. DIR sends the A&I form through Engage. We complete two parts:
      • CSP Acknowledgment of Texas Security Requirements: we name a security point of contact and a process for agencies to request our documents, and we authorize DIR to share the acknowledgment and inventory with agencies.
      • Information Security Documentation Inventory (ISDI): which security documents, questionnaires, and certifications we can provide to agencies on request.
    4. DIR approves the A&I and grants Provisional.
    5. DIR sends the full Assessment Questionnaire.
  • Duration: 12 months under Manual v4.0. [DISCREPANCY] DIR’s FAQ and eligibility pages still say 18 months, as does the manual’s own GovRAMP Snapshot paragraph. Treat 12 months as binding; it’s the newest board-approved text. Extensions (§12): +6 months at DIR’s discretion, another +6 if we’ve submitted and DIR hasn’t finished its review, possibly +3 more. DIR automatically adds 6 months if our full assessment is under review and expiry is at least 6 months away (§12.3).
  • One shot: once a provisional lapses without full certification, we cannot get a new provisional for that product (§12.1). So after we request it, the clock is running.
  • Cost: DIR charges nothing: “There are no fees associated with a TX-RAMP certification” (FAQ).
  • Time to grant: DIR doesn’t publish an SLA for the A&I. [UNCERTAIN] Vendor reports suggest a few weeks. DIR’s stated goal for a full assessment is a recommendation within 4 weeks once review begins, but the queue before that isn’t bounded (FAQ; Manual §16.1). We must answer DIR follow-ups within 10 business days or risk rejection.

Program changes to know about (2025–2026)

  • StateRAMP → GovRAMP rename (2025). The manual says “GovRAMP” should be read to include “StateRAMP.” GovRAMP added a Core tier, which TX-RAMP accepts as Level 2 (manual v3.1, May 2025).
  • Since 2024-10-30, FedRAMP and StateRAMP products are no longer added automatically. You must file a reciprocity request (FAQ).
  • Texas Cyber Command (TXCC): HB 150 (89R, 2025) moves DIR’s cybersecurity functions, including TX-RAMP, to TXCC. The rules move from 1 TAC Ch. 202 to 1 TAC Part 19, Ch. 477 effective 2026-08-01 (SOS transfer notice). DIR’s site and email (TX-RAMP@dir.texas.gov) still work during the migration (DIR news, txcc.texas.gov). [UNCERTAIN] Portal and email addresses may change to TXCC later in 2026–27. Check before submitting.
  • DIR holds TX-RAMP office hours on Wednesdays at 2:00 PM CT on Teams (link in FAQ). This is a free way to ask scope questions.

4. Full certification (Level 1 / Level 2)

There are three paths (Manual §9.1):

  1. DIR-conducted assessment (the free, self-attested path). We complete the Assessment Questionnaire in SPECTRIM:

    • system, company, and functionality questions
    • boundary diagram and data flow diagram uploads
    • the TX-RAMP Security Plan Workbook: an implementation narrative for each baseline control (117 or 223)
    • POA&Ms for every control that isn’t fully implemented

    Policies and procedures aren’t uploaded by default, but DIR “may request” them as evidence (§14.2). Incomplete submissions aren’t reviewed. No third-party audit is required on this path, which is the key fact for a two-person company with no SOC 2.

  2. Fast Track (§15). Submit a third-party report from the last 24 months, then answer a shorter Fast Track questionnaire. Accepted reports: SOC 2 Type 2, ISO 27001/27017/27018, HITRUST validated, PCI DSS ROC, CSA STAR Level II, FISMA. The report must cover our SaaS itself; AWS/Cloudflare reports don’t count. DIR won’t sign NDAs, so a submitted SOC 2 report is effectively disclosed to the state. Not available to us today.

  3. Reciprocity through another RAMP (§9.2).

    • FedRAMP Authorized → matching level. FedRAMP Ready or In Process → Provisional only.
    • GovRAMP Core, Ready, Provisional, or Authorized → TX-RAMP Level 2.
    • A GovRAMP Snapshot → Provisional (18-month cap).
    • GovRAMP Progressing Snapshot enrollment → Provisional for the length of enrollment.
    • FedRAMP LI-SaaS isn’t accepted.

    Reciprocal certifications need no TX-RAMP continuous-monitoring filings, but they’re revoked if the outside status is lost.

Subservice providers (§16.2): a SaaS does not inherit AWS or Cloudflare’s TX-RAMP certification. We can inherit their controls (mostly PE, parts of SC, CP, and MA) and must document the rest. The Supabase, Stripe, Resend, and Bedrock/AI subprocessors all sit inside our boundary diagram. [UNCERTAIN] I didn’t check whether Supabase or Cloudflare hold TX-RAMP or GovRAMP status; worth checking the certified products list.

Timeline and cost estimates for Gevell

PathCash costOur effortCalendar time
Provisional (A&I)$0~1–2 days (ISDI + acknowledgment)Weeks [UNCERTAIN]
Level 1 through DIR$0~3–6 weeks part-time (117-control workbook, diagrams, POA&Ms)Prep + queue + ~4-week review; plan for 3–6 months [ESTIMATE]
Level 2 through DIR$0~2–3 months part-time (223 controls; heavier AC/SC/CM/SA)Plan for 4–9 months [ESTIMATE]
GovRAMP Core → TX-RAMP L2~$10.5k/yr for <$1M revenue ($500 dues + ~$10k PMO fee per GovRAMP pricing; a third-party summary quotes $9k + $250/qtr, [UNCERTAIN]), no 3PAOSimilar to DIR L2 (60 controls, quarterly continuous monitoring)Months. Advantage: accepted by other states too.
GovRAMP Progressing Snapshot → TX-RAMP Provisional~$9.5k/yr (<$1M)LowBuys a provisional period tied to enrollment instead of the 12-month clock
SOC 2 Type 2 → Fast Track~$20k–60k+ (auditor + GRC tooling) [ESTIMATE, not from official sources]High; 3–12-month observation window6–12+ months

A realistic plan for Gevell: Provisional now, then Level 2 through the free DIR self-assessment within the provisional window. Consider GovRAMP Core only if other states start asking.

5. Recommendation

Start now, with Provisional. Reasons:

  1. It’s vendor-initiated, free, and needs no audit. The A&I is mostly an attestation plus an inventory of documents we already have or are drafting.
  2. It’s statewide. One certification covers UTHealth, UTSW, UT Austin, and every Texas public university, community college, and state agency. With the ADA Title II deadlines (2027-04-26 / 2028-04-26), Texas public institutions are our core market.
  3. Procurement at UT campuses stalls without it. UTSW says outright that it can’t contract without it.

Caveat on timing: the 12-month provisional clock can’t be restarted. Before submitting, (a) confirm with Victoria that UTHealth actually needs TX-RAMP for this PO, and (b) be ready to start the Level 2 workbook right away. The policies being drafted now (InfoSec, IR, BCP/DRP, onboarding/offboarding, vuln/patch, media disposal) are most of the foundation. If UTHealth decides the service is not subject to TX-RAMP (§6.1) or accepts it with a restricted-use clause, we could delay requesting Provisional until UTSW or a larger deal needs it. That wouldn’t waste the clock, but it only helps if nobody else is waiting on it.

Don’t call Gevell “TX-RAMP certified” or “in process” in marketing until DIR grants it. Referencing a non-certified service as certified is grounds for revocation (§19).

6. Questions for Victoria Adjei (UTHealth risk management)

  1. Scope: Has UTHealth decided Gevell PDF is a cloud computing service subject to TX-RAMP for this purchase? Could a §6.1 “non-substantive use of confidential data” determination apply if use is limited to public documents?
  2. Level: Which level will UTHealth require, Level 1 or Level 2? Would a contract clause limiting uploads to public/nonconfidential documents (no FERPA, no PHI) support Level 1?
  3. Provisional: Will UTHealth issue the PO and contract on a TX-RAMP Provisional certification? Does UTHealth need to be named in, or take part in, our DIR request?
  4. Timing: Can the PO be issued while the provisional request is pending? Does UTHealth have a transitional or exception process (e.g., CISO risk acceptance) for the gap?
  5. Pilot/threshold: Does UTHealth have any internal exemption for small or pilot purchases? (DIR’s rules have none; confirm UTHealth doesn’t either.)
  6. Other reviews: What else does their vendor risk review need: HECVAT (Full or Lite), a data-sharing/FERPA addendum, a security whitepaper, pentest results?
  7. Continuous monitoring: Will UTHealth require anything beyond TX-RAMP’s annual or quarterly vulnerability reporting, such as an annual pentest (UT System minimum requirements call for annual vuln/pentest on apps that process confidential data)?

7. Document checklist (maps to our drafts)

Needed forDocumentOur source / status
A&I: ISDI + security POCSecurity point of contact + document-request processName Larry; add a security@ alias. TODO
A&I: ISDIInformation Security Policydocs/admin/security-program/policies/information-security-policy.md (drafting)
A&I / IR family / breach 48hIncident Response Plan, with the TX-RAMP 48-hour notice and the Texas AG 250+ ruleDrafting. Add the TX-RAMP notification step.
CP familyBCP / Disaster Recovery Plandocs/admin/security-program/policies/disaster-recovery-plan.md (drafting)
PS family (8 controls at both levels)Onboarding/offboarding, access agreements, screeningdocs/admin/security-program/policies/personnel-onboarding-offboarding-policy.md. Gap: background screening for a two-person company; document it.
RA / SI families + continuous monitoringVulnerability & patch management (CVSS-based SLAs, reporting counts per Manual Table 1)docs/admin/security-program/policies/vulnerability-and-patch-management-policy.md (drafting)
MP familyMedia protection & disposalDrafting
Questionnaire uploadSystem boundary diagram + data flow diagramDerive from docs/admin/security/data-flow-subprocessors.md + security-whitepaper.md
SA family / §16.2Subprocessor inventory and inherited controls (AWS, Cloudflare, Supabase, Bedrock, Stripe, Resend)docs/admin/security/data-flow-subprocessors.md, ferpa-subprocessor-compliance.md
CA / RA familiesRisk assessment, pentest/vuln scan evidenceattack-surface-review.md, penetration-test-runbook.md. Gap: no external pentest yet.
AC / IA / SC / AU / CMAccess control, MFA, encryption, logging, config/change management standardsPartly in the InfoSec policy + secrets-inventory-and-rotation.md. Gap: a formal configuration/change management procedure
AT familySecurity awareness training recordGap
Whole workbookTX-RAMP Security Plan Workbook + POA&MsDownload the template from the Resources page when ready
Campus reviews (not TX-RAMP)HECVATdocs/admin/security/hecvat-draft.md

Sources