close button

Policies

Quality, Service Management, and Information Security

ITC Federal is committed to delivering secure, reliable, and high-quality services that advance the missions of our customers. Our integrated Quality Management System (QMS), Service Management System (SMS), and Information Security Management System (ISMS) are embedded across our operations to ensure operational excellence, customer satisfaction, continual improvement, and the protection of critical information assets.

Through disciplined governance, risk-based decision-making, and a culture of accountability, ITC delivers mission-focused solutions that meet contractual, regulatory, and stakeholder requirements while supporting secure and resilient operations.

Certifications and Appraisals

ITC maintains compliance with internationally recognized standards and frameworks, including:

  • ISO 9001:2015 – Quality Management Systems
  • ISO/IEC 20000-1:2018 – Service Management Systems
  • ISO/IEC 27001:2022 – Information Security Management Systems
  • CMMI Services (CMMI-SVC) Appraised
  • CMMI Development Level 3 (CMMI-DEV v1.3) Appraised
  • Cybersecurity Maturity Model Certification (CMMC), Level 2

Quality Policy

ITC is a quality-focused company committed to providing our customers with professional services that meet or exceed requirements and expectations. Quality is directly linked to customer satisfaction, and customer satisfaction creates our competitive advantage. Our quality management system ensures we meet corporate and customer objectives and consistently deliver the highest quality across all aspects of our business. Our entire team is committed to upholding this quality policy and meeting the needs of every customer.

Service Management Policy

ITC’s Service Management System (SMS) ensures consistent, high-quality service delivery to all of our customers. Top Management is committed to meeting our customers’ requirements and continually improving the effectiveness of our services and the SMS by adhering to an established Policy for Continual Improvement. An active Management Review Board (MRB) provides oversight and is responsible for establishing policy and objectives, as well as annual review for continued suitability.

  • Services are delivered by a defined quality, sufficient to satisfy requirements identified from our established business processes
  • A service catalog was developed and is maintained as a basis for all service delivery and service management activities
  • A corporate service level agreement (SLA), which has been designed, agreed upon, and signed by each service leader, is in place and is reviewed periodically to ensure the service meets internal and customer requirements
  • All required processes are defined, communicated, and improved based on business needs and feedback from relevant stakeholders
  • Roles and responsibilities for each service line are clearly defined and identified in ITC’s Service Catalog

Information Security Management Policy

ITC’s information security policy is designed to protect the confidentiality, integrity, and availability of systems and information assets that contain ITC information by preventing and reducing the potential impact of security incidents. ITC manages assets and the associated risks and maintains an Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2022. ITC further aligns its information security controls with the Cybersecurity Maturity Model Certification (CMMC) Level 2 and NIST Special Publication 800-171 for the protection of Controlled Unclassified Information (CUI). Computer information systems and networks are integral to business at ITC. The company has made a substantial investment in human and financial resources to create these systems.

ITC’s policies and directives have been established to ensure that:

  • ITC’s information assets are safeguarded against internal, external, deliberate, or accidental threats
  • Information assets are protected from unauthorized access
  • Confidential and other information, such as Personally Identifiable Information (PII) will be properly maintained and controlled
  • Services and information assets are managed to support their integrity
  • Services that enable the availability of information assets will be managed in accordance with ITC’s services
  • Continuity of Operations Plans and tests are maintained to support the availability and return-to-service of assets in case of unforeseen circumstances
  • Regulatory, legislative, and contractual commitments related to information security are met and supported by methods to capture and review emerging requirements
  • Information Security orientation and training are provided to all employees to reduce the likelihood of security incidents
  • Information security incidents and events are promptly identified, reported, and addressed