City of Arlington, Texas & GovRAMP
Why GovRAMP?
The City of Arlington leverages GovRAMP to standardize cloud security requirements, streamline procurement, and strengthen protection of community data and critical infrastructure. Through alignment with nationally recognized NIST-based controls, Arlington ensures cloud services meet consistent, risk-based standards while reducing redundancy for vendors.
By participating in GovRAMP, the City of Arlington leverages third-party verification to protect sensitive data and uphold public trust. Through adherence to industry-standardized controls, Arlington streamlines cloud service procurement and accelerates vendor onboarding. Standardizing security requirements eliminates redundant audits and reduces costs and administrative effort for both the City and its technology partners.
Safeguarding critical infrastructure is a top priority for Arlington’s cybersecurity strategy. Robust GovRAMP controls help protect essential services.
Equally important is the protection of community data, ensuring privacy and maintaining the integrity of digital records strengthens trust between the City and its constituents. By embracing GovRAMP, Arlington demonstrates its commitment to operational efficiency, vendor collaboration, and the resilience of its essential services.
City of Arlington's GovRAMP Determination
The City determines a vendor’s compliance with its cloud‐security standard by evaluating each product against the following requirements and processes:
-
Scope & Applicability
Any “cloud service,” whether IaaS, PaaS, SaaS, hosted products, or even on-premises hardware with a cloud component, must hold either GovRAMP Core or TX-RAMP Level 2 certification.
-
Certification Timelines
New Services (Initial Procurements): Certification must be in place on or before the date the starts using the cloud service.
Renewals: For existing services, the vendor has a 180-day window to achieve the requisite certification. -
Preference for GovRAMP
While TX-RAMP Level 2 also meets baseline requirements, the City will favor products that carry GovRAMP Core certification when evaluating and selecting cloud products.
-
Exemption Process
If a vendor believes a given product neither processes Confidential data nor is mission-critical, it may submit a written exemption request to the City’s Information Security and Privacy Office at security@arlingtontx.gov. The City’s Chief Information Security Officer, or delegate, will review and must approve or deny that request within 15 business days of receipt.
-
Continuous Monitoring
Products leveraging GovRAMP status must remain in good standing. Vendors must grant the City, and its auditors, visibility into their continuous monitoring artifacts via the GovRAMP portal.
-
Non-Compliance, Notification, & Cure
The City considers a product “Non-Compliant” if the vendor fails to:
-
Obtain the required certification; or
-
Maintain that certification thereafter.
Upon detecting Non-Compliance, the City will issue a written notice outlining the specific deficiencies and corrective steps required. The vendor then has a 30-day “Cure Period” to restore compliance. If more time is needed, the vendor may request an extension in writing before the Cure Period expires; any extension is granted solely at the City Chief Information Security Officer’s discretion.
-
City of Arlington & GovRAMP
GovRAMP Office Hours
Please join the GovRAMP staff on the first Wednesday of every month from 2:30 – 3:00 PM ET for Office Hours. This is an open forum for Service Providers, 3PAOs, State and local governments, and higher education institutions to ask questions to GovRAMP staff.
For more information on office hours, please visit the GovRAMP Event Page.
Frequently Asked Questions
-
What is GovRAMP?
Founded at the beginning of 2020, GovRAMP was born from the clear need for a standardized approach to the cybersecurity standards required from service providers offering solutions to state and local governments.
As a 501(c)6 nonprofit, our mission is to promote cybersecurity best practices through education and policy development to improve the cyber posture of public institutions and the citizens they serve. GovRAMP is comprised of service providers offering IaaS, PaaS, and/or SaaS solutions, third-party assessment organizations, and government officials. Our members lead, manage, and work in various disciplines across the United States and are all committed to making the digital landscape a safer, more secure place.
-
What is the value of GovRAMP for both the City of Arlington and its citizens?
GovRAMP provides significant benefits to both the City of Arlington and the residents it serves. For the city, GovRAMP enhances cybersecurity through a standardized, multi-level framework for evaluating and securing cloud service providers, helping reduce the risk of cyber threats and data breaches. It also streamlines procurement by establishing consistent security requirements, allowing Arlington to more efficiently identify and work with trusted vendors while reducing the need for redundant security assessments. This standardized approach can also result in cost savings by leveraging transferable security credentials across government sectors.
For Arlington's citizens, these benefits translate into stronger protection of personal and sensitive information, greater confidence in the security of government systems, and improved delivery of public services through secure and reliable cloud technologies. Additionally, participation in GovRAMP demonstrates Arlington's commitment to cybersecurity, transparency, and responsible stewardship of public data, helping build trust between the city and its residents. -
How do I get a GovRAMP status?
To learn more about how to obtain any of our GovRAMP statuses, visit our GovRAMP for Service Providers page. This page provides an overview of the GovRAMP organization, general onboarding information, a getting started checklist, and complete details regarding the requirements for beginning the GovRAMP verification process.
-
What are the continuous monitoring requirements?
Continuous monitoring involves regular security status checks of a cloud solution, conducted monthly or quarterly. This process starts once the product reaches a GovRAMP milestone status such as Core, Ready, Provisionally Authorized, or Authorized. The purpose of continuous monitoring is to ensure that the service provider’s solution is meeting security requirements and maintaining a secure system state. It provides insights into vulnerabilities, allowing service providers to address issues and comply with GovRAMP standards. By identifying areas of risk, continuous monitoring enables service providers to take prompt action to protect the system.
For more information, refer to the Continuous Monitoring Guide on the Security Overview page located under the Resources section.
Continuous monitoring must be maintained for the lifecycle of your contract with the City of Arlington, and upon request, access to the product’s security package and continuous monitoring artifacts must be granted to the City.
-
How do I enroll in the GovRAMP Progressing Security Snapshot Program?
To participate:
- Become a GovRAMP Member
- Submit a Progressing Security Snapshot Request
- Pay the applicable fee
- Receive onboarding instructions from the GovRAMP PMO
You’ll receive:
- A Snapshot score within ~3 weeks of payment
- Quarterly updated Snapshots
- Monthly one-hour consultative calls with GovRAMP’s security team
If you’re responding to a solicitation, note your time constraints on the request form so we can prioritize accordingly.
-
How much does a GovRAMP assessment cost?
To continue supporting Arlington's small- and medium- sized businesses including veteran and minority owned businesses, the GovRAMP assessment fees are tiered based on the annual revenue for the company. This pricing structure is designed to make participation more accessible while encouraging organizations of all sizes to strengthen their cybersecurity posture.
For more information, please visit Pricing Overview | GovRAMP.
In addition, GovRAMP offers a 3PAO Discount Program that rewards providers for investing in security improvements. Organizations that complete the Progressing Security Snapshot program or achieve Core Verification may qualify for discounted assessment rates, helping reduce costs and accelerate their path toward Ready or Authorized Verification.
-
How much does it cost to engage with a Third-Party Assessment Organization?
The cost of engaging a Third-Party Assessment Organization (3PAO) varies based on factors such as the size and complexity of the environment, scope of the assessment, and overall security readiness. Because 3PAOs are independent organizations that establish their own pricing, GovRAMP is unable to provide a standard cost range.
To help reduce assessment costs, GovRAMP offers a 3PAO Discount Program, which provides eligible service providers access to discounted assessment services through participating 3PAOs.
Please note that a 3PAO is only required when pursuing a GovRAMP Ready or Authorized status.
-
What are the guidelines for determining if my product is a cloud computing service?
The City of Arlington, Texas identifies three distinct service models for the cloud environment:
Infrastructure as a Service (IaaS) is a cloud environment with computing resource such as virtual servers, storage, and network. The consumer uses their own software, including operating systems, middleware and applications. The underlying physical infrastructure is managed by the Cloud Service Provider (CSP).
Platform as a Service (PaaS) is a cloud environment for development and management of consumer applications. It includes the infrastructure layer – virtual servers, storage and network – while tying in middleware and development tools to allow the consumer to deploy their applications. It is designed to support the complete development lifecycle while leaving the management of the physical infrastructure to the CSP.
Software as a Service (SaaS) is a cloud computing solution that provides the consumer with access to a complete software product. The application resides on a cloud platform and is accessed by the consumer through a web interface or application program interface (API). The physical and virtual infrastructure, operating system, middleware and application are all managed by the CSP.
-
Who can I contact to get started?
For questions or more information about GovRAMP, please contact: info@govramp.org.
For questions specific to the City of Arlington, please contact security@arlingtontx.gov
Contact Us
If you have any questions for the City of Arlington, please contact security@arlingtontx.gov
For additional information on how to get started with the GovRAMP process, please contact info@govramp.org.
GovRAMP Participating Governments
GovRAMP is accepted by the City of Arlington, Texas and other states. See a list of GovRAMP’s participating governments here.
STAY INFORMED
Receive Updates and Resources
Subscribe to receive program updates, educational briefings, and public sector implementation insights.