State agency risk and compliance consulting in Texas: what to expect

Good state agency risk and compliance consulting in Texas should leave your agency or university with controls that have been assessed and tested against TAC 202 and the Texas Cybersecurity Framework, written up the way the biennial information security plan asks, and now extended to the AI systems your agency uses. You should expect a written scope, a fixed fee, named deliverables with dates, and evidence your own staff can keep current after the consultant leaves. Anything vaguer than that is a slide deck.

This guide is for CIOs, information security officers and internal auditors scoping outside help. It covers the state obligations at a high level, what reviewers look for, the common findings, what your procurement team will ask a vendor, and how an engagement with us runs. We are based in Austin and work with Texas agencies remote or on site.

This page is general information, not legal advice. Your general counsel and DIR's own guidance govern how a requirement applies to your organization.

The Texas information security standards, at a high level

Three pieces matter most to agencies and institutions of higher education.

TAC 202. Texas Administrative Code chapter 202 sets the minimum information security and cybersecurity responsibilities and roles for state agencies and institutions of higher education. It points agencies to the TAC 202 Security Controls Standards Catalog, which is built on NIST SP 800-53 Revision 5. Public community and junior colleges were brought under TAC 202, and so under the state agency cybersecurity training requirements, by SB 64 in 2019.

The Texas Cybersecurity Framework. This is the structure the security plan uses. Agencies rate each of the framework's security objectives on a maturity scale from 0, non-existent, to 5, optimized.

The biennial cycle. State law requires each state agency, including institutions of higher education, to keep an information security plan, update it periodically, and submit it by June 1 of each even-numbered year. Plans have been filed through DIR's SPECTRIM portal, but cybersecurity functions are moving to the Texas Cyber Command, so confirm where to file. A separate information security assessment, done at least every two years, includes a look at the agency's data governance program.

How these apply to a university system, a standalone university or a junior college is not always identical to how they apply to an executive branch agency. Confirm with DIR and your counsel which reporting duties and exemptions apply to you before you scope the work.

Preparing the biennial information security plan

The plan is a self-assessment, and that is its weakness. A maturity score is only as good as the evidence behind it, and many agencies fill in the template with whoever happens to be in the room.

A better sequence:

1. Assess the controls first, then score them. Pick the objectives where a score would change a decision, and test them: pull the user list, the change records and the training logs, and see whether the control ran.
2. Bring in the vulnerability report. DIR expects the plan to consider the agency's vulnerability report, include the network security services DIR provides, and define staff responsibilities for custody of agency information.
3. Get the executive acknowledgement signed early. The plan includes a written acknowledgement, signed by executive staff, of the risks identified during planning, and DIR provides a standard form for it. Brief the signer on what the risks mean, not just where to sign.
4. Keep sensitive detail out of written copies. State law says written copies of the plan should leave out information that could expose network or system vulnerabilities. Your counsel can advise on how the Public Information Act applies to the security material you hold. Keep the detailed workpapers in your systems, and keep the plan itself at the level the template asks for.

The next plan is due 1 June 2028. Confirm the filing portal, since cybersecurity functions are moving from DIR to the Texas Cyber Command. Assessment work that starts a year earlier leaves time to fix what it finds, so the plan describes controls that already operate.

State AI law, in general terms

The 89th Legislature added obligations for agencies that use AI, and they sit beside the security plan rather than inside it. In general terms:

• Governmental entities must tell people when they are interacting with an AI system, and the Information Resources Deployment Review now covers agency AI system inventories.
• DIR is to publish an AI code of ethics and minimum risk management standards for heightened scrutiny AI systems, both aligned with the NIST AI Risk Management Framework. Agencies must adopt the code and post a standardized notice where AI is public-facing or a controlling factor in a consequential decision.
• State employees now take AI awareness training. DIR's free course does not track completions, so the agency has to keep its own record.
• Agency AI contracts may carry reporting duties and remedies for violations of state AI law, so check the current statute and your contract terms.

The Texas Responsible Artificial Intelligence Governance Act has been in force since 1 January 2026, enforced by the Attorney General with a sixty day cure period. It gives a defense to a party that substantially complies with the most recent NIST AI RMF Generative AI Profile or another nationally or internationally recognized AI risk management framework.

For agencies, our work here has three parts: an inventory of the AI systems in use, a NIST alignment memo under the Act, and controls over the automated decisions that touch the public. Writing the policy is the start. Testing whether the notice shows where it should, and whether a person reviews the decision when the policy says one will, is where the value is.

Control assessment and evidence state reviewers accept

Reviewers, internal auditors and the State Auditor's office tend to accept evidence that a control ran during the period, shown in a record. A description of how the control is supposed to work does not count. Evidence that holds up looks like this:

• Training completion logs for cybersecurity and AI training, by employee, with dates and the course used.
• The signed executive risk acknowledgement, kept with the risks it acknowledges.
• An AI system inventory that includes the AI inside your ERP, your case management system and your vendors' platforms, not only the tools someone bought as AI.
• Vendor cloud status checked at each contract and renewal. State law limits agencies to cloud services that comply with TX-RAMP, and vendors must stay certified for the contract term. Record the status you saw and the date you checked.
• Access reviews and change records that show who reviewed what and what they did about exceptions.

Most of these artifacts serve more than one reviewer. TAC 202's catalog derives from NIST 800-53, so one access review can be mapped to TAC 202, NIST CSF 2.0, and the controls a SOC 2 or TX-RAMP review asks about. Build the evidence once, index it, and map it.

Internal audit and controls advisory

For agencies covered by the Texas Internal Auditing Act, internal audit plans are built from a risk assessment, and the approved plan and annual report are posted on the agency's website. That makes IT and AI risk visible to the public as well as to the board or commission.

Outside help can support internal audit without taking it over. That might mean testing IT general controls to the standard an external auditor applies, so your auditors can use the workpapers. It might mean a second opinion on whether a finding is classified correctly. It might mean a quarterly read of the control program for an audit committee or board with no controls specialist on it. For agencies and universities that spend federal awards, the Single Audit adds IT and compliance controls to the list. The threshold is one million dollars or more of federal award spending in a fiscal year, for fiscal years beginning on or after October 1, 2024.

Common findings, and how to avoid them

• Maturity scores the evidence does not support. Test before you score.
• Training that happened but was not recorded. Keep your own completion log, especially for AI training.
• An unsigned or late executive acknowledgement. Put it on the calendar with the filing date.
• Cloud contracts renewed without a fresh TX-RAMP check. Make the check a step in the renewal workflow and file the result.
• An AI inventory limited to obvious tools. Ask every system owner and vendor what in their product makes or shapes a decision.
• Vulnerability detail in documents that circulate. Keep it in the restricted workpapers.
• Access and change controls described but not evidenced. These are where we look first, because every other control depends on them.

Procurement: what your agency will ask for

Texas agencies generally have to buy IT commodity items through DIR's cooperative contracts unless they get an exemption, and they must meet competitive bid thresholds on IT purchases. Your purchasing office decides which route fits a given engagement. Ask them early, because the route sets your timeline.

For vendor onboarding, we keep the usual items ready, listed on our easy to hire page. The contracting entity is Limnal Holdings, LLC, a Texas limited liability company, and the W-9 and insurance certificate carry that name. A certificate for professional liability, general liability and cyber coverage is issued with the signed agreement. We complete your security questionnaire. We do not hold a SOC report, so we are assessed on the questionnaire and our practices. We register in your supplier portal, complete your supplier diversity self classification and policy acknowledgments, and consent to a background check through your provider before access is granted.

Your records stay in your systems, and we will work on a device or virtual desktop you issue. Work starts when the purchase order issues, invoices carry the PO number, and work product belongs to you. Contractors with access to agency systems must complete a state-certified cybersecurity training program, now certified by the Texas Cyber Command, so add it to your onboarding checklist., so add it to your onboarding checklist.

How an engagement runs

1. A free two hour scoping call. We look at your systems, your last plan and your calendar, and say what we would do and what we would leave alone. If a scope needs more than a call, a two week scoping sprint is the paid first step, credited in full against the engagement.
2. A short letter with a fixed fee. It names the deliverables, the dates and the fee before any work begins.
3. A one page status every week. It covers what was done, what is blocked and what you need to decide.
4. Handoff and retest. You get the workpapers, the evidence index and a gap list with an owner and a date on every line. We retest what was remediated and confirm the result in writing.

The guarantee is written into the letter. If an external auditor, an examiner or a regulator writes up a deficiency on a control we documented and tested, we remediate it at no charge. If a control fails testing for a reason in our work, that deliverable's fee is refunded. Twenty percent of each fixed fee is held back until testing of the controls in scope is complete with no deficiency attributable to our work. The full lines of work are on our services page.

Every engagement is run by Gray Faulkner, who spent years in Big Four and national firm risk practices defending work through PCAOB inspections. More is on the about page.

Start with a scoping call. Send the filing date or review on your calendar and a sentence on what is coming up.

Frequently asked questions

Will you write and submit our biennial plan for us?

We assess and test the controls and write up the results the way the plan asks. The plan, the maturity scores and the executive acknowledgement remain the agency's, and your staff submit them.

Are you on a DIR contract?

Ask your purchasing office which procurement route applies to the engagement you have in mind. We will complete your vendor forms and portal registration for whichever route they choose.

Can you work with our internal audit department?

Yes. We build workpapers to the standard an external auditor applies, so internal audit can use them. How much they rely on the work is their decision. Our work is advisory and is not an audit or attest engagement.

Do you give legal opinions on the Texas AI law?

No. We build and test the controls, and we write the NIST alignment memo your general counsel can file. Interpreting the statute stays with your counsel.

How long does a TAC 202 assessment take?

The scoping call sets the scope, and the letter puts the dates and the fee in writing. Start far enough ahead of the filing date that remediation and a retest fit before the plan is due.