The capital writes the rules for state IT. Then Austin's software firms have to sell into them.
In Austin the same question comes from two directions. An agency CIO asks whether a SaaS tool can hold confidential data. The vendor's product team asks what TX-RAMP Level 2 will make them change. We work on both sides of that table.
In Austin we work with state agencies, universities and tech companies on identity, cloud security controls and AI governance.
Agency work tends to be access governance, proof of annual training and the new state AI rules. SaaS vendors usually need their product ready for TX-RAMP certification so a state customer can sign. We're based in Frisco and travel to Austin for workshops and assessments.
We're headquartered in Frisco and serve Austin clients remotely, with trips down I-35 for discovery, assessment interviews and go-live support. We don't keep a separate office in Austin.
- rules
- TX-RAMPTexas Gov't Code §2054.5191, cybersecurity trainingHB 3512 , AI awareness trainingSB 1964 , public-sector AI governanceTRAIGA , government provisions
What's specific about Austin
Each figure comes from a public source, linked on the card.
By the Dallas Fed's Austin profile, the State of Texas is the city's biggest employer and the University of Texas comes second. IT manufacturing and services runs at 2.8 times the national concentration.
source ↗ 02 11.1%High-tech jobs were 11.1% of Austin employment in 2021, against 6.7% in Dallas–Fort Worth and 4.2% nationally, the Dallas Fed found.
source ↗ 03Any state agency, public university or community college buying cloud services needs them TX-RAMP certified. That's been required for Level 2 services since 1 January 2022 and for Level 1 since 1 January 2024.
source ↗ 04HB 2818 created DIR's AI Division. It now runs the Public Sector AI Sandbox under SB 1964, and it certifies the annual AI awareness training that HB 3512 requires of many state and local employees.
source ↗Who we work with in Austin, and the rules they work under
-
State agencies and public universities
Agencies run on a mix of mainframe-era case systems and new SaaS, with access often granted by ticket and never reviewed. Universities add students, adjuncts and researchers who hold three roles at once. We set up identity governance that maps to the state's security control standards, then make the annual training and access-review evidence fall out of the system instead of a spreadsheet chase each August.
-
Software, semiconductors and hardware
Austin SaaS companies selling to Texas government need tenant isolation, MFA for administrators, logging and vulnerability management they can document for a TX-RAMP assessment. Chip fabs and hardware makers in the corridor have a different problem, which is controlling contractor and tool-vendor access into manufacturing networks without stopping a production line.
-
TX-RAMP (Texas Gov't Code §2054.0593) ↗
Cloud computing services sold to state agencies, public universities and community colleges need TX-RAMP certification. Level 1 covers public or low-impact data; Level 2 covers confidential or regulated data. Products holding SOC 2 Type II, ISO 27001 or FedRAMP may qualify for a fast-track review.
-
Texas Gov't Code §2054.5191, cybersecurity training ↗
Every year, state and local government employees who spend at least a quarter of their duties on a computer must complete a DIR-certified cybersecurity training program, and so must elected and appointed officials. Agencies then report compliance to DIR.
-
HB 3512 (2025), AI awareness training ↗
Adds an annual AI training requirement alongside the cybersecurity one, for applicable state and local government employees and officials. The programs are ones DIR certifies.
-
SB 1964 (2025), public-sector AI governance ↗
Sets the state's framework for how government entities procure and deploy AI, directs DIR to build a Public Sector AI Sandbox, and has DIR adopt rules for heightened-scrutiny AI systems.
-
TRAIGA (HB 149), government provisions ↗
Requires governmental entities to disclose when people interact with AI, adds agency AI system inventories to the Information Resources Deployment Review, and creates the Texas Artificial Intelligence Council.
Most requested in Austin
The services clients in Austin ask us for most.
01We sell SaaS to Texas agencies. Where do we start with TX-RAMP?
Pick the level first. It depends on the most sensitive data a state customer will put in your product. Then put your controls next to the TX-RAMP baseline. Already have SOC 2 Type II, ISO 27001 or FedRAMP? Check whether the fast-track route applies. We help close the identity, logging and configuration gaps. DIR runs the certification.
02Is there a fee for TX-RAMP certification?
DIR does not charge vendors for it. Your costs are the engineering work to meet the controls and the time to assemble evidence.
03How do agencies keep track of the annual cybersecurity and AI training?
Most agencies track it in a learning system and reconcile everything by hand just before the reporting deadline. We'd rather link completion data to the identity platform. Then access to sensitive systems can depend on current training, and the compliance report is just a query.
04Our agency wants to pilot an AI assistant. What does SB 1964 change?
It means the pilot needs governance from the start. Classify the use case and log it in your AI inventory. Tell the public AI is involved where TRAIGA requires it, and check DIR's rules for heightened-scrutiny systems. We set up the agent's own identity so it only touches data the use case was approved for.
05Do you work with universities as well as agencies?
Yes. Higher education falls under TX-RAMP too, and its identity problems are harder. One directory often holds students, staff, faculty, alumni and research collaborators.
06Can you help a chip or hardware plant with vendor access?
Yes. We put tool-vendor and contractor access to manufacturing networks behind brokered, recorded sessions with time limits, and keep the plant's own engineers on a separate, stricter path.
0c7f0c07 - 01Dallas Fed, At the Heart of Texas, Austindallasfed.org ↗
- 02Dallas Fed, High-tech hotspot Austin (March 2023)dallasfed.org ↗
- 03Texas DIR, TX-RAMP eligibility and requirementsdir.texas.gov ↗
- 04Texas DIR, AI in Texas implementation of 89th Legislature lawsdir.texas.gov ↗
- 05Texas Government Code chapter 2054statutes.capitol.texas.gov ↗
- 06Texas HB 3512, enrolled textcapitol.texas.gov ↗
- 07Texas SB 1964, enrolled textcapitol.texas.gov ↗
- 08Texas HB 149, enrolled textcapitol.texas.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it