The Texas Department of Information Resources (DIR) released version 3.0 of their TX-RAMP Program Manual, effective 12/1/2023.
A noteworthy change included the addition of a transitional grace period that enables state agencies to create and leverage a transition plan from a non-compliant TX-RAMP solution (cloud service) to a compliant solution in the event a compliant solution’s TX-RAMP certification lapses or is revoked. The timeline for transition may not exceed 24 months from inception to execution. TWU is responsible for developing, documenting, and adhering to a transition plan that meets the minimum criteria:
- Identification of Affected Services: Clearly list and describe the services affected by the lapse or revocation of certification.
- Timeline for Transition: Provide a realistic and achievable timeline for the migration to a compliant solution, including key milestones and deadlines. The timeline for transition may not exceed 24 months from planned inception to execution.
- Risk Assessment: Conduct a risk assessment to identify and mitigate potential security and operational risks during the transition.
- Selection of Compliant Solution: Detail the process for selecting a TX-RAMP compliant solution that meets the TWU's needs.
- Migration Strategy: Outline the methods and procedures for migrating data and operations to the new solution, ensuring data integrity and availability.
- Monitoring and Reporting: Establish ongoing monitoring and internal reporting mechanisms to track progress and address any challenges or delays promptly.
- Contingency Planning: Include contingency measures to address unexpected issues or delays, ensuring uninterrupted service delivery.
System owners that need to replace a solution that is not TX-RAMP compliant may request a transitional grace period. The TWU Information Security team will review requests and will work with the system owner to develop this plan. System owners should initiate the request by completing the TX-RAMP Transitional Grace Period form by clicking Request Service on this page. To expedite the request, the system owner should have information from the list above ready to submit in the form.