Security Review Calculator

This guided tool covers three TAMU IT security assessments in a single workflow: Data Classification, Impact Level, and TX-RAMP scoping. You can run all three or just the ones you need. Answer each question and the next will appear automatically. A report can be downloaded when you finish.

First, what is the name of the IT product or information resource you are evaluating?

Nothing you enter is saved or transmitted. Every answer stays in your browser and is lost when you close or refresh this page.

Assessment Setup Which assessment would you like to run for this resource?

Cloud Service Determination Determine whether this product meets the NIST SP 800-145 definition of a cloud computing service, and which service model delivers it Data Classification Determine how sensitive this data is — Public, University-Internal, University-Confidential, or Critical Impact Assessment Determine the security impact level for controls and documentation. You'll specify the data classification level directly — best used when you already have a Data Classification result for this resource. Data Classification + Impact Assessment Classify the data and determine the security impact level used for control selection and documentation Complete Security Assessment (includes TX-RAMP scoping) Classify the data, assess security impact, and determine whether TX-RAMP certification is required — recommended for evaluating cloud services and vendor-hosted systems

How is this resource delivered?

Service models are defined in NIST SP 800-145.

Software-as-a-Service (SaaS)You use the vendor's finished application — you don't manage servers or deploy code Platform-as-a-Service (PaaS)You deploy your own application or database onto a platform the vendor runs Infrastructure-as-a-Service (IaaS)You manage the operating system, virtual machines, or storage the vendor hosts Not a cloud serviceRuns on-premises or in a colocation facility rather than as a vendor-hosted offering

What kinds of data will this resource store, process, or transmit?

Select everything that applies. Anything you identify here will not be asked about again later.

Research and university business

Research dataAny research data. We'll ask next whether it is subject to special controls. Other university business dataAdministrative, operational, or departmental information not listed above

None of these

None of the aboveThis resource holds no regulated, research, or internal university data

Is any of the research data in this resource subject to special controls?

Most research data is not. Special controls means the data is export-controlled, classified, designated as CUI, or covered by an IRB protocol.

No special controls applyEveryday research data with no added handling requirements Yes, special controls applyExport-controlled, classified, CUI, or IRB-covered — you'll pick which below

Select all that apply:

CUI research data Export-controlled research data Classified research data IRB / human-subject research data Other research data under special controls

Answer these questions and we'll determine which special controls apply.

Is the research funded or governed by a contract that restricts who may access the data — for example by citizenship, nationality, or security clearance? Points to: export-controlled or classified research

Yes No

Did the sponsor designate any of the data as Controlled Unclassified Information (CUI), or does the award include a DFARS or NIST SP 800-171 clause? Points to: CUI research data

Yes No

Does the research involve human subjects under an approved IRB protocol? Points to: IRB / human-subject research data

Yes No

Answer the questions above to see which controls apply.

Effect of unavailability or compromise

For each item below, indicate what would happen if this resource were unavailable or compromised. The impact level is set by the most severe outcome that applies, following the TAC §202.5 impact designation criteria.

My unit (e.g., college or division) would be unable to perform one or more of its primary functions.

Yes No

Catastrophic harm — loss of life or serious life-threatening injury — to individuals could occur.

Yes No

My unit could experience _______ financial loss as a result.

Judge this relative to your unit's own budget, not the university's.

Minor Significant Major

My unit could experience _______ reputational damage as a result.

Minor Significant Major

Possible exemption from TX-RAMP certification

Is the confidential information limited to data necessary for providing a login capability?

For example, a name and email address used only to create and access an account.

Yes — only what a login requires No — other confidential data is involved

Is the confidential information negligible?

TAMU defines negligible confidential data as University-Confidential data that, if its confidentiality, integrity, or availability were compromised, would have no adverse effect on university assets, university operations, or any individual — and that contains no regulated data, personally identifiable information (PII), or human-subject data. All four questions below must be answered "No" to qualify.

Would a compromise of this data have any adverse effect on Texas A&M University assets?

Yes No

Would a compromise of this data have any adverse effect on Texas A&M University operations?

Yes No

Would a compromise of this data have any adverse effect on any individual?

Yes No

Does this data contain regulated data, personally identifiable information (PII), or human-subject data?

Yes No

Answer the four questions above to see whether this data qualifies as negligible.

About this tool

This combined assessment integrates the TAMU Data Classification Calculator (based on the TAMU Data Classification Policy), the Impact Calculator (based on TAC §202.5 impact designation criteria), and the TX-RAMP Scoping Calculator (implementing the scoping decision tree from DIR's TX-RAMP Scoping Tool and the TX-RAMP Program Manual v4.0, February 2026). Individual calculators are also available for standalone use. For questions, contact TAMU IT Security & Risk.

Assessment Complete

Cloud Service Determination

Data Classification

Impact Level

TX-RAMP Determination

About this tool