Subcontractor Risk Management and Third-Party Oversight

Seattle Public Schools is seeking a contractor to establish and implement a formal third-party risk management program focused on assessing and continuously monitoring subcontractors and subprocessors for security posture and regulatory compliance. The initiative requires a structured framework to identify, evaluate, and mitigate risks associated with external parties handling sensitive data or critical systems, ensuring alignment with industry standards and institutional security expectations. The effort will involve ongoing surveillance, vendor due diligence, contractual enforcement, and reporting mechanisms to maintain accountability across the extended supply chain. This subcontract falls under NAICS code 541611, indicating it relates to management consulting services, and is part of broader efforts to strengthen operational resilience within the district’s technology and service infrastructure. While the place of performance and specific deliverables are not detailed, the program must be scalable, adaptable to evolving threats, and capable of integrating with existing compliance frameworks. The contractor is expected to bring expertise in cybersecurity governance, risk assessment methodologies, and third-party oversight best practices, delivering a sustainable system that supports the district’s commitment to data protection and regulatory adherence. The solicitation was posted on July 22, 2026, and is accessible through the provided UI link for further details.