Subcontractor Compliance & Third-Party Risk Management

The contract requires support to the prime contractor in ensuring subcontractors adhere to stringent security and privacy requirements aligned with EOTSS and federal standards. This includes conducting thorough vetting of prospective subcontractors, drafting and negotiating compliant agreements, implementing ongoing monitoring mechanisms, and producing accurate, timely reporting on compliance status. The scope spans the full lifecycle of third-party risk management, from initial assessment through continuous oversight, with emphasis on safeguarding sensitive government data and systems. Performance is centered in Boston, Massachusetts, with all activities governed by the regulatory frameworks enforced by the Executive Office of Technology Services and Security. The work is critical to maintaining the integrity of state technology infrastructure and requires deep familiarity with federal compliance protocols and state-specific security directives. Subcontractor agreements must be structured to enforce accountability, and any deviations or breaches must be identified, documented, and remediated promptly to uphold operational security and regulatory standing.