Meeting risk management requirements for the STARS III government contract – including CMMC plans
A new RFP was recently released – the 8(a) Streamlined Technology Acquisition Resource for Services (STARS) III Governmentwide Acquisition Contract (GWAC), also known as “STARS III.” As described in the RFP, this is “a Multiple Award, Indefinite-Delivery, Indefinite-Quantity (MA-IDIQ) contract to provide information technology (IT) services and IT services-based solutions which may include the integration of ancillary support which is necessary and integral to the IT services being acquired. STARS III Master Contract awards are reserved exclusively for qualifying Small Business Administration (SBA) certified 8(a) prime contractors with competitive prices.”
What offerors should know before applying for this award is that the RFP requires each applicant to document a plan that addresses the actions their organization has taken to identify, manage, and mitigate supply chain and cybersecurity risks. The plan must also demonstrate how the organization intends to achieve compliance with the new Cybersecurity Maturity Model Certification (CMMC), at what maturity level, and by when.
Offerors must meet these requirements in order to be considered for the award. As per M.6 of the RFP, “The Cybersecurity and SCRM [Supply Chain Risk Management] Assessment will be evaluated on a pass/fail basis.” L.16 of the RFP says:
“Offerors must submit a brief (7 pages or less) written cybersecurity and SCRM assessment which addresses actions taken to identify, manage and mitigate supply chain and cybersecurity risk. The assessment must address the offeror’s intention in regards to obtaining CMMC, the target certification level, and a tentative timetable for attaining it. The assessment must identify any cybersecurity or SCRM related industry certifications currently held by the offeror, to include ISO certifications (e.g. ISO/IEC 27001:2013, ISO 28000:2007 and ISO 9001:2015). The assessment must also provide a narrative of how hardware, software, firmware/embedded components and information systems are protected from component substitution, functionality alteration, and malware insertion while in the supply chain; and explain how the offeror will maintain a high level of cybersecurity and SCRM readiness for performance of IT services to federal customers.”

Bhavesh Vadhani, Principal, CohnReznick Advisory
703.847.4418
Kristen Soles, CPA, Partner, Government Contracting Practice Leader
703.847.4411
Related Services
-
InsightGovCons: Proactively assess your compliance programMaurice L. Crescenzi Jr., Rich MeeneGovCons face extensive requirements for protecting against fraud and misconduct. Get a list of key rules and regulations, plus top steps to meeting them.
-
InsightPre-award compensation considerations: The best things in life aren’t freeCaitlin Lewis, Hareem MalikThere are many components to pre-award compensation for government contractors; and the RFP requirements are the best place to start to determine compensation costs and requirements. Learn more.
-
On-demandMastering the GovCon dealBetter understand key considerations for M&A transactions and integrations in the GovCon space. Our panel of experts will cover the risk, opportunity, and deal value across the lifecycle of the typical deal. Register now.
-
On-demandDemystifying incurred cost audits for government contractorsAttend this webinar to learn about the overall incurred cost audit process so you can be better prepared to navigate your own incurred cost audit successfully.