Third-Party Security Certification (Annual)

The contract requires annual submission of one of four recognized cybersecurity certifications—FedRAMP, SOC 2 Type 2, HITRUST CSF, or ISO 27001—for cloud services to meet state-level compliance mandates. This subcontract is issued by the North Carolina division of the Department of Health and Human Services and is intended to ensure that third-party cloud providers maintain a robust and standardized security posture aligned with public sector expectations. Submissions must be current and valid at the time of annual renewal, and the certification must directly apply to the cloud services being used or offered under this agreement. The solicitation was posted on May 11, 2026, with responses due by July 17, 2026, and is categorized under NAICS code 541611, which pertains to computer systems design and related services. The place of performance and specific office address details are not provided, indicating that the certification requirement applies broadly to cloud services delivered to North Carolina state agencies regardless of physical location. The contract is structured as a subcontract, meaning it likely supports a larger prime agreement and focuses exclusively on maintaining documented compliance rather than service delivery. Failure to submit a valid certification annually may result in termination of service eligibility or non-compliance penalties under state cybersecurity policy.