A platform can help you prepare for GovRAMP and TX-RAMP, but it can't grant either: GovRAMP statuses come from the GovRAMP program, and TX-RAMP certification comes from Texas DIR. ComplianceONE's support is limited, and we list what is and isn't open below. Use the nine-question checklist with every vendor.
What do GovRAMP and TX-RAMP actually ask a cloud provider to show?
GovRAMP describes itself as "a nonprofit community providing a clear, risk-based pathway" for governments and providers (govramp.org). Its security program is "Built on NIST SP 800-53 Rev. 5", and its Core controls are "aligned to the NIST SP 800-53 Rev. 5 Moderate baseline" (security program). Pages we read on November 3, 2026 describe these pathways:
| GovRAMP pathway | What govramp.org says | Independent assessor (3PAO)? |
|---|---|---|
| Security Snapshot | PMO-validated assessment of 40 foundational NIST controls | Not required |
| Core | PMO-validated, based on 60 prioritized NIST controls | "Core verification does not require a 3PAO." |
| Ready | Independently assessed, based on 80 NIST controls | Required |
| Authorized / Provisional | Comprehensive assessment of 300+ NIST controls | Required for Authorized |
Core, Ready and Authorized/Provisional statuses are valid for 12 months from the award date (service providers page). The same page says templates are organized by "Low, Moderate, and High impact levels".
TX-RAMP is run by the Texas Department of Information Resources (DIR). DIR says it "provides a standardized approach for security assessment, certification, and continuous monitoring" of cloud services that process Texas state agency data (DIR TX-RAMP page). It describes two levels: Level 1 "for public/non-confidential information or low impact systems," and Level 2 "for confidential/regulated data in moderate or high impact systems" (eligibility page).
Can one platform's work carry over between GovRAMP and TX-RAMP?
Partly, and the direction matters. GovRAMP's Texas page says "GovRAMP security statuses are recognized by TX-RAMP" but "TX-RAMP certification does not grant GovRAMP status." It lists Core, Ready, Provisional and Authorized as meeting TX-RAMP Level 2 requirements and does not say which GovRAMP statuses meet Level 1 (GovRAMP: State of Texas, read November 3, 2026).
So a platform that keeps your control work in one place, and shows where one requirement meets another, can save you re-answering the same question. It doesn't replace the program's own review.
What does ComplianceONE cover?
We mark our own GovRAMP and TX-RAMP support as limited, not fully open. Here is the line between what you can install and what you can't:
| Framework | You can install after your account is approved | Not open |
|---|---|---|
| GovRAMP | Low, Core, Moderate, High | Low+ (listed, not open) |
| TX-RAMP | Level 1, Level 2 | Provisional (not open) |
Two cautions on those labels. First, in the product, our TX-RAMP content covers Level 1 and Level 2. DIR's pages describe TX-RAMP as Level 1 and Level 2 under a numbered Program Manual, so ask any vendor, us included, which Program Manual version its content follows and when it was last checked. Second, our Low, Core, Moderate and High are the parts of the framework you install in the product. They aren't GovRAMP's status stages (Security Snapshot, Core, Ready, Authorized/Provisional), which we don't grant and no software can. Core is also a GovRAMP status name; installing our Core content gives you the controls to work from, not that status.
ComplianceONE is a documentation platform. For TX-RAMP, the System Security Plan step produces a Security Plan Workbook. Where the same requirement appears in another framework you've installed, it finds the equivalent and copies nothing until you click Import, Apply or Copy.
What should you ask any platform before you buy?
Ask every vendor the same questions and write the answers down.
| # | Question | A good answer | A warning sign |
|---|---|---|---|
| 1 | Which GovRAMP levels and TX-RAMP levels can I install today? | A list by level, including what is not open | "All of them" with no list |
| 2 | Which GovRAMP baseline and which DIR Program Manual version does the content follow? | A named version and date | "Latest," no version |
| 3 | Is every level fully built, or are some marked limited or coming? | A plain split between available and planned | Roadmap items shown as available |
| 4 | Who grants the status? | "GovRAMP" or "DIR," never the platform | "We get you certified" |
| 5 | Does Ready or Authorized need a 3PAO, and does the platform say so? | Yes, with your 3PAO doing the assessment | Implied that software replaces the assessor |
| 6 | What documents does it generate (system security plan, TX-RAMP workbook, policies)? | Named documents you can open before you sign | A promise of "audit-ready" |
| 7 | If I also answer to FedRAMP or NIST 800-171, do I re-enter controls? | Mapped equivalents you approve | Separate copies of everything |
| 8 | What is the vendor's own security status, in its exact words? | A status you can verify on the program's site | "Certified" or "authorized" with no listing |
| 9 | Who approves my account, and what do you do with my data? | A plain answer in writing | Vague hosting claims |
Check the answer to question 8 on the program's own site, not on the vendor's. Our own status is: Pursuing FedRAMP 20x Class C. Listed on the FedRAMP Marketplace (FR2700754082), Initial Implementation phase. We use ComplianceONE on our own environment.
Which framework should a vendor start with?
It depends on who your buyer is. If a Texas state agency, university or community college is buying, TX-RAMP applies to cloud services that process its data. The DIR eligibility page says state agencies, institutions of higher education and public community colleges are covered. If your buyer is a government that uses GovRAMP, start with GovRAMP's pathways. The Texas page above shows one way the two connect.
How long TX-RAMP Provisional status lasts is set in DIR's current Program Manual, and DIR's own pages name different manual versions, so read the current manual before you plan around any figure.
Frequently asked questions
Does a compliance platform make me GovRAMP or TX-RAMP certified?
No. GovRAMP statuses are awarded through the GovRAMP program, and for Ready and Authorized an accredited 3PAO does the independent assessment. TX-RAMP certification comes from Texas DIR. A platform helps you prepare documents and evidence.
Do I need a 3PAO for GovRAMP?
For Ready and Authorized, yes. The GovRAMP service providers page says those verifications "require independent assessment activities performed by an accredited 3PAO", and that Core does not.
Does my GovRAMP status count for TX-RAMP?
For Level 2, GovRAMP lists Core, Ready, Provisional and Authorized as recognized. It does not say which GovRAMP statuses meet Level 1. TX-RAMP certification doesn't give you a GovRAMP status. The page was read November 3, 2026, so check it before you rely on it.
Does ComplianceONE support GovRAMP Low+ or TX-RAMP Provisional?
No. Neither is open. We install GovRAMP Low, Core, Moderate and High, and TX-RAMP Level 1 and Level 2, and we describe that support as limited.
Is GovRAMP the same as FedRAMP?
No. GovRAMP is its own program. Its Federal Overlay "Aligns GovRAMP impact levels with federal standards, including FedRAMP Rev. 5" (security program), and GovRAMP is "Built on NIST SP 800-53 Rev. 5". They are separate programs with separate statuses.
Next step
Pick the two or three platforms you're comparing and send them the nine questions above. If you'd like to see how ComplianceONE answers them, including what is open and what isn't, book a demo and we'll walk you through it.
This post explains public program material and is not legal advice. ComplianceONE does not certify, authorize or assess anyone, and no software makes an organization certified or authorized. ComplianceONE is not affiliated with or endorsed by GovRAMP or the Texas Department of Information Resources.