Overview
Security requirements · assessment scope
Assessment scope, framework revision and evidence requirements are established for the engagement. No current SPRS score or completed assessment is asserted here.
Define the assessment boundary
We can scope a review of applicable security requirements, the evidence available and gaps needing remediation. A written assessment must identify the system boundary, framework and date.
Verify submission requirements
If the procurement requires an SPRS assessment, its submission and status must be verified for the specific entity and system. A portal role does not establish a submitted score.
Not a 3PAO assessment
ITC does not claim a third-party assessment. Where an assessment is required, confirm the assessor, prerequisite work, timing and applicable contract requirement before bidding.
CMMC Level 2 · readiness stance
ITC does not hold CMMC certification. The applicable solicitation and contract requirements control any readiness work or assessment dependency.
Review the applicable controls
A scoped gap assessment can identify required documentation and remediation. This page does not attest that all controls are implemented.
Not yet scheduled
No completed C3PAO assessment or scheduled assessment is represented here.
Confirm assessment dependencies
If a requirement applies at award or performance, it must be satisfied by that deadline. Including assessment cost in a proposal does not satisfy the requirement.
Check each party’s obligations
A prime contractor’s certification does not automatically cover a subcontractor. Assess requirements and system boundaries for each party before agreeing work share.
Advisory scope · credentials not held
The left column lists topics for scoped advisory work. The right column identifies credentials and operating capabilities that must not be assumed.
- Hosting requirements and provider authorization review for the intended workload
- Network and identity requirements assessment
- Applicable control and documentation requirements review
- Endpoint protection requirements and deployment planning
- Administrative access and multifactor authentication requirements
- Access-review cadence and role-change responsibilities
- Security-awareness training requirements
- Incident response planning and exercise scope
- Service-organization attestations of any type · not held, not in audit, not preparing
- FedRAMP authorization · ITC is not authorized
- CMMC Level 1, 2, or 3 certification · readiness only
- ISO 27001 certification · not held
- HUBZone: no · prior application denied 2023; solicitation disclosure remains “HUBZone: no”
- SBA 8(a) program participation · application submitted 2026 and under SBA review, not awarded
- GSA MAS award · not held directly
- NYS MWBE · not held. The 2026 Fast Track route was closed to ITC as a Delaware-formed entity; no standard application is pending today
- TAA compliance without solicitation-specific scoping
- Brand-name flow-downs from primes without a written sub-agreement
- Standing 24/7 SOC or NOC operations
- 3PAO formal assessment under DFARS 252.204-7012 · scoped per engagement
Platform reviews are not certifications
Winrove compliance tracking records obligations and review evidence inside an engagement. A review in the platform does not issue a certification or attestation, and a product feature does not change the credentials ITC holds.
Credentials, registrations and applications
Held credentials, entity registrations and a submitted application are different statuses. Review the status relevant to your procurement.
DSBS #MWCERT2022-353
NYC Department of Small Business Services. Expires 2027-05-31. NMSDC-certified MBE · NY/NJ MSDC · through 2027-06-30.
Active through 2027-06-11
UEI PR9KWJPM4JU9 · CAGE 91CE1. Reps and certs current. NAICS list filed.
Application under review
Application submitted in 2026, under SBA review. This is not program participation or an award.
Registered vendor
NYC PASSPort vendor VS00075284. NYC MBE certified through 2027-05-31.
Discuss the required evidence
Six evidence topics to discuss for the actual requirement. Supporting records, availability and permitted disclosure are reviewed before sharing.
Required SPRS evidence
Describe the assessment and submission evidence your procurement requires. ITC does not assert a current submitted score on this page.
Required SSP + POA&M
Describe the system boundary, applicable controls and required security documentation. Availability of specific completed records must be verified before sharing.
DFARS 252.204-7012 representation
Flow-down requirements are reviewed against the solicitation and proposed work. No blanket clause-compliance attestation is made here.
CMMC gap-assessment scope
A gap-assessment scope should define the system, framework, required evidence and deliverables. No completed client assessment is presented as a case study here.
Insurance requirements
Workers’ Compensation is the active coverage recorded with The Hartford. Cyber, General Liability and other coverage requirements are addressed during contracting; this page does not claim those policies are bound.
Referee list past engagements
Two recorded public-sector hardware engagements are described on our past-performance page. They are not security-services references or customer attestations.
Describe the requirement. Identify the evidence needed
Submission evidence assessed per requirement