Texas first: AI and cloud investments mapped to your rules and to the budget each one draws on.

Texas (state agencies)Key date: September 1, 2025

TX-RAMP: the state risk and authorization management program for cloud services (Gov. Code §2063.408, formerly §2054.0593)

In force; transferred to Gov. Code §2063.408 by HB 150 (effective September 1, 2025): the Texas Cyber Command establishes the program and evaluates vendors, and the program rules moved to 1 TAC chapter 477 on August 1, 2026. DIR's TX-RAMP team runs assessments and certification until the transfer completes, no later than December 31, 2026.

“A state agency may not enter or renew a contract with a vendor to purchase cloud computing services for the agency that are subject to the state risk and authorization management program unless the vendor demonstrates compliance with program requirements.”

What we do: We design on cloud services that hold the TX-RAMP certification level your agency requires, and list each service's level before design starts.

Source: TX-RAMP (statutes.capitol.texas.gov) (opens in a new tab) · Checked November 10, 2026

TexasKey date: September 1, 2025

Texas Cybersecurity Framework and the Texas Cyber Command (HB 150)

TCF current (42 control objectives); HB 150 created the Texas Cyber Command (Gov. Code ch. 2063); DIR's information security standards moved to 1 TAC chapter 477 on August 1, 2026, and the transfer of DIR's cybersecurity functions completes no later than December 31, 2026.

“currently consists of 42 total security control objectives”

What we do: The Secure milestone maps the identity, network and data-boundary controls on your platform to the Texas Cybersecurity Framework control objectives, as evidence your security team can use in its security plan.

Source: Texas Cybersecurity Framework and the Texas Cyber Command (dir.texas.gov) (opens in a new tab) · Checked November 10, 2026

Texas (state agencies)Key date: September 1, 2025

Texas DIR cooperative contracts for commodity technology (Gov. Code §2157.068)

In force; DIR's rule (1 TAC §212.10) has state agencies other than institutions of higher education buy listed commodity items, which by statute include technology services, through DIR contracts unless they first obtain a DIR exemption, express prior Legislative Budget Board approval or DIR's certification that the item is unavailable. Local governments are eligible DIR customers.

“The department may adopt rules regulating a purchase by a state agency of a commodity item under this section, including a requirement that, notwithstanding other provisions of this chapter, the agency must make the purchase in accordance with a contract developed by the department”

What we do: We are available as a subcontractor or teaming partner to the DIR cooperative contract holder your agency chooses.

Source: Texas DIR cooperative contracts for commodity technology (statutes.capitol.texas.gov) (opens in a new tab) · Checked November 10, 2026

Texas (state agencies; major information resources projects)Key date: September 1, 2005

Texas Project Delivery Framework: business case (Gov. Code §2054.303) and post-implementation review (§2054.306)

In force since September 1, 2005; applies to major information resources projects: projects in a state agency's biennial operating plan with development costs above $5 million that take a year or more to reach operations, involve more than one agency or substantially alter work methods or service delivery, projects the Legislature designates, and projects designated for additional monitoring with development costs above $5 million (Gov. Code §2054.003(10)).

“After implementation of a major information resources project, a state agency shall prepare a post-implementation review.”

What we do: For Texas major information resources projects, the Business Case Sprint drafts the business case and workbook on DIR's templates for your agency to approve and file, and the Run milestone measures the outcomes your post-implementation review compares with the business case.

Source: Texas Project Delivery Framework (statutes.capitol.texas.gov) (opens in a new tab) · Checked November 10, 2026

U.S. (participating state and local governments)Key date: November 1, 2026

GovRAMP security program (verification statuses)

Current program built on NIST SP 800-53 Rev. 5.

“Built on NIST SP 800-53 Rev. 5”

What we do: We list each proposed cloud service's GovRAMP status for your project and design on the services your government accepts.

Source: GovRAMP security program (govramp.org) (opens in a new tab) · Checked November 10, 2026

GovRAMP Authorized Product List; vendor statement (Microsoft Learn)Key date: April 24, 2022

Microsoft services on the GovRAMP Authorized Product List

GovRAMP Authorized Product List: Microsoft Azure Government and Microsoft Azure Commercial at High, Authorized, April 24, 2022; M365 Government Community Cloud & Supporting Services at High, Authorized, July 21, 2024; Microsoft 365 Commercial at Moderate, Core, November 20, 2025.

“To be covered by the GCC GovRAMP Authorization, customers must purchase a GCC SKU.”

What we do: We confirm each service's status on the GovRAMP and TX-RAMP lists for your project before design starts.

Source: Microsoft services on the GovRAMP Authorized Product List (govramp.org) (opens in a new tab) · Checked November 12, 2026

U.S. federal and state (criminal justice information)Key date: June 25, 2026

FBI CJIS Security Policy (v6.1) and Microsoft CJIS agreements

CJIS Security Policy v6.1 released June 25, 2026; Texas audits through March 31, 2027 use v5.9.5.

“All Texas CJIS audits through March 31, 2027 are conducted against FBI CJIS Security Policy version 5.9.5.”

What we do: Criminal-justice data stays inside the Microsoft government services your state's CJIS agreement covers, and we design to the policy version your auditor uses.

Source: FBI CJIS Security Policy (dps.texas.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal and state (federal tax information)Key date: November 2021

IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies

Rev. 11-2021 current (IRS Safeguards page, last reviewed June 28, 2026). An early-release draft, Rev. 12-2026, takes effect 6 months after its publication date and adds a section on artificial intelligence.

“Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies … (Rev. 11-2021)”

What we do: Federal tax information stays inside the authorized government cloud boundary your safeguards review relies on, and we design the data platform to the current Publication 1075.

Source: IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies (irs.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal (HHS)Key date: January 6, 2025

HIPAA Security Rule: proposed rule to strengthen the cybersecurity of ePHI (RIN 0945-AA22)

Proposed January 6, 2025; Unified Agenda lists it under Long-Term Actions with final action 07/2027; the current Security Rule applies.

“HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information”

What we do: Where your agency is a HIPAA covered entity, such as a public hospital or a state Medicaid program, we keep protected health information in your tenant, work under a business associate agreement signed before any access, and map the design to the HIPAA Security Rule in force.

Source: HIPAA Security Rule (reginfo.gov) (opens in a new tab) · Checked November 10, 2026

U.S. (educational agencies and institutions)Key date: January 8, 2009

FERPA: contractors as school officials (34 CFR 99.31(a)(1)(i)(B))

In force since January 8, 2009 (final rule of December 9, 2008, 73 FR 74806); §99.31 last amended December 2, 2011.

“Is under the direct control of the agency or institution with respect to the use and maintenance of education records”

What we do: Where education records are in scope, the contract places our work under your direct control and FERPA's redisclosure limits.

Source: FERPA (ecfr.gov) (opens in a new tab) · Checked November 10, 2026

U.S. (community water systems serving more than 3,300 people)Key date: October 23, 2018

America's Water Infrastructure Act §2013: risk and resilience assessments and emergency response plans

In force. This cycle's risk and resilience assessment certifications were due March 31, 2025, December 31, 2025 and June 30, 2026, by system size; emergency response plans follow six months after each assessment certification, the last on EPA's schedule by December 31, 2026; reviews repeat at least once every five years.

“electronic, computer, or other automated systems (including the security of such systems)”

What we do: Utility twin, operational-data and capital-planning work is scoped so its findings can feed the risk and resilience assessment and the emergency response plan a community water system reviews and certifies to EPA at least once every five years.

Source: America's Water Infrastructure Act §2013 (epa.gov) (opens in a new tab) · Checked November 10, 2026

U.S. federal (agencies and recipients of federal grants and cooperative agreements)Key date: December 22, 2025

American Security Drone Act and OMB M-26-02: drones bought or operated with federal funds

In force; the grant-funds prohibition applies on or after December 22, 2025.

“Pursuant to section 1825 of the American Security Drone Act of 2023 (Public Law 118-31), on or after December 22, 2025, the following prohibition applies to the use of funds provided through any Federal grant, cooperative agreement, or other award”

What we do: When federal funds are involved, we screen every drone option against the federal prohibited-source rules before it enters the comparison.

Source: American Security Drone Act and OMB M-26-02 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026

U.S. (states without an approved State Plan, including Texas)Key date: December 29, 1970

OSHA coverage of state and local government workers (State Plans)

In force: the OSH Act's definition of employer leaves out states and their political subdivisions (29 U.S.C. 652(5)); OSHA lists 22 State Plans covering private sector and state and local government workers and seven covering state and local government workers only, and Texas is under federal OSHA jurisdiction for most private sector workers.

“State and local government workers are not covered by federal OSHA.”

What we do: In Texas we build the safety case for a municipal robot pilot on the robot-safety standards and your own safety program, include the federal OSHA duties of the contractors on site, and follow the State Plan in states with public-sector plans.

Source: OSHA coverage of state and local government workers (osha.gov) (opens in a new tab) · Checked November 10, 2026

U.S. (state and local government accounting)Key date: June 15, 2022

GASB Statement No. 96: Subscription-Based Information Technology Arrangements

Effective for fiscal years beginning after June 15, 2022.

“A SBITA is defined as a contract that conveys control of the right to use another party's (a SBITA vendor's) information technology (IT) software, alone or in combination with tangible capital assets (the underlying IT assets), as specified in the contract for a period of time in an exchange or exchange-like transaction.”

What we do: For state and local governments, the business case models how subscription payments and implementation costs may be treated under GASB Statement No. 96, and your auditors determine the classification.

Accounting treatment is determined by your auditors; we provide evidence and documentation.

Source: GASB Statement No. 96 (gasb.org) (opens in a new tab) · Checked November 10, 2026