Public-facing compliance documentation for procurement officers, primes, and partners. Live canonical pages on itcustomsolution.com/compliance-posture. This repo mirrors the highlights for buyers who'd rather read in GitHub.
| Framework | Status | Detail |
|---|---|---|
| NIST SP 800-171 Rev. 3 | 🟡 No current assessment asserted | We do not assert a current SPRS score or a completed self-assessment. Assessment scope, framework revision and evidence are established per engagement. Not a third-party DFARS 252.204-7012 / CMMC assessment. |
| CMMC Level 2 | 🟡 Readiness stance, not certified | We have not yet scheduled a formal Level 2 assessment with a C3PAO. When a solicitation requires it, we scope the C3PAO engagement into the proposal cost basis, OR team with a prime that already holds the cert. |
| Section 508 / WCAG 2.2 AA | 🟡 Conformance not established | Our published accessibility status report (9 Sept 2026) states that full WCAG 2.2 AA conformance is not established for the current website. It is a scoped status report, not a completed VPAT or an independent audit. |
| NIST SP 800-53 | 🟡 Subset operational | Applicable controls operational under our SaaS infrastructure (Cloudflare + Railway + Supabase). Not a FedRAMP authorization. |
| FedRAMP | ❌ Not authorized | We use FedRAMP Moderate substrates (Azure GovCloud, GCP federated) and document the inheritance, but ITC itself is not a FedRAMP-authorized service. |
| SOC 1 / SOC 2 | ❌ Not certified · not in progress | We do not claim SOC certifications. If a solicitation requires SOC 1 or SOC 2, ITC is a NO-BID unless the prime holds the certification and ITC operates as a subcontractor within the prime's authorization boundary. |
| HIPAA | 🟡 BAA-capable | Will sign Business Associate Agreement when a customer engagement involves PHI. |
- Legal name · IT Custom Solution LLC
- UEI · PR9KWJPM4JU9
- CAGE · 91CE1
- EIN · (available under mutual NDA · canonical on SAM.gov)
- NYC MBE Cert · MWCERT2022-353 (valid through 2027-05-31)
- SBA 8(a) · Application submitted 2026, under SBA review
- SAM.gov · Registered, active
- Workers compensation · Hartford-backed, on-policy continuously
- General liability · Hartford-backed, bound on-award per project
- COI delivery · <24 hour SLA for any client / portal request
| Document | Location | Format |
|---|---|---|
| Capability statement | https://itcustomsolution.com/capability-statement.pdf | |
| Accessibility status report (not a VPAT) | https://itcustomsolution.com/accessibility-conformance-report.pdf | |
| Privacy policy | https://itcustomsolution.com/privacy | Web |
| Security policy | https://itcustomsolution.com/compliance-posture | Web |
| Past performance | https://itcustomsolution.com/past-performance | Web |
Email sales@itcustomsolution.com with:
- Your buying organization name
- The contract vehicle / solicitation reference (if applicable)
- NDA preference (your template or ours)
We respond within one business day.
We publish a deliberately narrow list of operational claims. We do NOT assert:
- A current SPRS score, a completed NIST SP 800-171 self-assessment, or CMMC certification
- Section 508 / WCAG 2.2 AA conformance
- A DCAA-audited or DCAA-approved accounting system
- SOC 1 / SOC 2 in any form (certified, in progress, preparing, readiness, equivalent)
- HUBZone certification (parent firm denied 2023; rep-and-cert disclosure on solicitations is "HUBZone: no")
- GSA Schedule / MAS holder status (we are pursuing, not holding)
- 8(a) certified (application submitted; under SBA review)
- NYS MWBE (not held; the 2026 Fast Track route was closed to ITC as a Delaware-formed entity, and no standard application is pending today)
- ISO 27001 certification (not pursued)
- FedRAMP authorization (we use FedRAMP-authorized substrates; ITC itself is not authorized)
- TAA compliance without solicitation-specific scoping
- Brand-name flow-downs from primes without written sub-agreement
If a solicitation requires any of these as a hard pass/fail gate, we either (a) team with a prime that holds it, (b) scope the certification cost into the proposal, or (c) NO-BID.
- Sales / RFP responses · sales@itcustomsolution.com
- Compliance questions · lu@itcustomsolution.com
- Phone · +1 (646) 671-3399
This repo mirrors the canonical compliance posture published at https://itcustomsolution.com/compliance-posture. The live page is the source of truth; this repo is a GitHub-native mirror for procurement officers who prefer reading documentation alongside the codebase.