Buyer guidance on security scope, evidence and procurement representations. The current ITC compliance posture is the canonical public page; this README summarizes the boundaries to check before an engagement.
A security review, a software feature and a certification are different things. ITC can discuss a scoped requirements review, evidence gaps and a remediation plan. An engagement must identify the system, information, framework, responsibilities and acceptance criteria that apply. Public source code and test results do not establish certification or an accepted live customer workflow.
| Topic | Boundary |
|---|---|
| NIST SP 800-171 / SPRS | No current SPRS score or completed assessment is asserted here. Verify the applicable framework revision, system boundary, assessment and submission evidence for the requirement. |
| CMMC | ITC does not claim CMMC certification or a completed or scheduled C3PAO assessment. Readiness work is not certification. |
| NIST SP 800-53 / FedRAMP | No blanket control implementation or ITC FedRAMP authorization is asserted. Any provider authorization and inherited controls must be checked for the actual service and workload. |
| SOC 1 / SOC 2, ISO 27001 | ITC does not claim these attestations or certifications. |
| Section 508 / WCAG 2.2 AA | Full conformance is not established. The published accessibility status report is scoped reporting, not a completed VPAT or independent audit. |
| Healthcare information | This page makes no clinical or HIPAA certification claim. Data handling, access controls and any required agreement must be reviewed before an engagement involving sensitive records. |
| Accounting | No DCAA-audited or DCAA-approved accounting system is asserted. |
A prime contractor's credentials do not automatically cover a subcontractor. Check the requirements for each party and system before agreeing work share. Budgeting for an assessment does not satisfy a credential required at award or performance.
- Consult the current credentials page and the issuing authority's records for applicable status, scope and expiry.
- SBA 8(a) participation, HUBZone certification, a direct GSA MAS award and NYS MWBE status are not claimed here. An application or registration is not a certification or award.
- Insurance coverage, limits, endorsements and certificates must be verified for the engagement. This README makes no coverage or certificate-delivery SLA commitment.
| Document | Location |
|---|---|
| Capability statement | ITC capability statement |
| Accessibility status report | Scoped accessibility report |
| Privacy policy | Privacy |
| Security and procurement scope | Compliance posture |
| Published engagement evidence | Past performance |
See cybersecurity and compliance advisory for the service scope. Describe your requirement or email sales@itcustomsolution.com with the buying organization, solicitation or work package, required evidence and relevant deadline. Keep credentials, private bid material and sensitive personal records out of public issues and initial inquiries.
Supporting records, permitted disclosure, delivery resources and any NDA are reviewed before sharing or making a commitment. An inquiry does not establish a certification, price, response-time promise or contract.