CPA, Partner - Managing Partner, Advisory - Global Consulting Solutions and Government Contracting Industry Leader
View full biography
Meeting risk management requirements for the STARS III government contract – including CMMC plans
A new RFP was recently released – the 8(a) Streamlined Technology Acquisition Resource for Services (STARS) III Governmentwide Acquisition Contract (GWAC), also known as “STARS III.” As described in the RFP, this is “a Multiple Award, Indefinite-Delivery, Indefinite-Quantity (MA-IDIQ) contract to provide information technology (IT) services and IT services-based solutions which may include the integration of ancillary support which is necessary and integral to the IT services being acquired. STARS III Master Contract awards are reserved exclusively for qualifying Small Business Administration (SBA) certified 8(a) prime contractors with competitive prices.”
What offerors should know before applying for this award is that the RFP requires each applicant to document a plan that addresses the actions their organization has taken to identify, manage, and mitigate supply chain and cybersecurity risks. The plan must also demonstrate how the organization intends to achieve compliance with the new Cybersecurity Maturity Model Certification (CMMC), at what maturity level, and by when.
Offerors must meet these requirements in order to be considered for the award. As per M.6 of the RFP, “The Cybersecurity and SCRM [Supply Chain Risk Management] Assessment will be evaluated on a pass/fail basis.” L.16 of the RFP says:
“Offerors must submit a brief (7 pages or less) written cybersecurity and SCRM assessment which addresses actions taken to identify, manage and mitigate supply chain and cybersecurity risk. The assessment must address the offeror’s intention in regards to obtaining CMMC, the target certification level, and a tentative timetable for attaining it. The assessment must identify any cybersecurity or SCRM related industry certifications currently held by the offeror, to include ISO certifications (e.g. ISO/IEC 27001:2013, ISO 28000:2007 and ISO 9001:2015). The assessment must also provide a narrative of how hardware, software, firmware/embedded components and information systems are protected from component substitution, functionality alteration, and malware insertion while in the supply chain; and explain how the offeror will maintain a high level of cybersecurity and SCRM readiness for performance of IT services to federal customers.”
To formulate the CMMC plan required by STARS III, now is the time to start evaluating how you can achieve the specific level of maturity required for your organization based on Controlled Unclassified Information (CUI) and types of services and programs your organization supports for Department of Defense (DOD) or expects to handle and provide in the future. The first step will be to map the gaps between your existing security processes, practices, and controls and the requirements for the CMMC maturity level you are seeking to achieve.
Whether or not you decide to pursue the STARS III contract, CMMC compliance has become a cost of doing and staying in business with the DOD, and it is looking likely that this will soon be the template for the whole federal government. All DOD contractors and subcontractors are encouraged to become CMMC-compliant and independently audited to pursue DOD contracts by late 2020.
Bhavesh Vadhani, Principal, CohnReznick Advisory
703.847.4418
Kristen Soles, CPA, Partner, Government Contracting Practice Leader
703.847.4411
Related Services
This has been prepared for information purposes and general guidance only and does not constitute legal or professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is made as to the accuracy or completeness of the information contained in this publication, and CohnReznick LLP, its partners, employees and agents accept no liability, and disclaim all responsibility, for the consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it.
Bhavesh N. Vadhani
CISA, CRISC, CGEIT, PMP, CDPSE, Principal, Global Leader, Cybersecurity, Technology Risk, and Privacy
View full biography
Resources for GovCon to increase competitiveness & lower the cost of compliance
Subscribe
Access Our Government Contracting Topic Page for Key Insights & Powerful Tools
Explore insight collection
Related Insights
-
InsightGovernment contractors: Retain top talent and stay competitiveTheresa Gonzalez, Caitlin LewisKey factors for government contractors to consider when it comes to attracting and retaining top talent include offering more flexibility on teleworking and competitive compensation plans. Learn more.
-
On-demand2022 GAUGE Report: Reimagining the workforceJoin the authors of the GAUGE Report for a sneak peek of the 2022 results, based on the GAUGE Survey where 1,000+ contractors were polled in five main areas of contracting: Government Contract Compliance, Accounting, Utilization, Growth, and Efficiencies. During the webinar, the presenters will share new data around today’s changing workplace including employee perks, benefits, and compensation plans.
-
On-demandPost-merger integration success stories and guidance for GovConsDesigned for GovCon executives, accounting and finance departments, HR managers, IT managers, operations, and commination personnel, this webinar will cover an overview of the key milestones in successful post-merger integration.
-
InsightGovernment contractor valuation tracker: H1 2022In this latest Government Contractor Valuation tracker, we share key valuation indicators to help GovCon management teams and investors keep track of industry valuation benchmarks and trends.