SOC 2 Compliance Reporting (Service Provider)

The contract requires the provision of annual SSAE 18 and SOC 2 Type II compliance reports, along with an initial Type I report, to validate the security, availability, processing integrity, confidentiality, and privacy controls surrounding data handling and network operations for deployed systems. This engagement is structured as a subcontract under the Transportation agency’s Iowa office, with performance centered in Ames, and is governed by NAICS code 541611, indicating it falls under management consulting services. The reporting obligations are critical for ensuring ongoing adherence to industry-standard controls and demonstrating trustworthiness to stakeholders reliant on the integrity of the service provider’s infrastructure. Bidders must submit responses by June 17, 2026, at 8:00 PM, following the posting of the opportunity on May 20, 2026. The contract does not specify a set-aside classification or a designated point of contact, and the place of performance does not include a zip code or state designation beyond the city of Ames. Interested parties are directed to the Iowa bid portal for full solicitation details, though the core deliverables remain focused on compliance validation through formal audit reports that confirm operational controls meet the requirements of the SOC 2 framework, with Type I establishing baseline control design and Type II validating ongoing operational effectiveness over a defined period.