Compliance Statement

1. Introduction

Government Contracting Authority (GCA) is committed to maintaining the highest standards of cybersecurity and compliance, particularly for government contracting operations. Our comprehensive approach to information security ensures that all systems, processes, and personnel meet or exceed federal requirements for protecting classified, sensitive, and controlled information.

2. CMMC Compliance

GCA is committed to achieving and maintaining CMMC v2.0 Level 2 (Advanced) certification. This certification demonstrates our dedication to implementing advanced cybersecurity practices equivalent to NIST SP 800-171 standards for protecting Controlled Unclassified Information (CUI) in nonfederal systems.

3. NIST SP 800-171 Compliance

GCA has implemented all applicable controls from NIST SP 800-171 Revision 2. Our information systems have been assessed by an independent Third-Party Assessment Organization (3PAO) and found to be compliant with 100% of applicable controls. This comprehensive compliance demonstrates our commitment to protecting CUI throughout our operations.

4. FedRAMP Compliance

GCA's information systems comply with the FedRAMP Moderate baseline, which incorporates NIST SP 800-53 security controls. Our cloud services have been verified by a certified FedRAMP Third-Party Assessment Organization and achieved 100% compliance with all applicable controls.

5. DFARS 252.204-7012 Compliance

GCA strictly adheres to DFARS 252.204-7012 requirements for Safeguarding Covered Defense Information and Cyber Incident Reporting. Our cloud service providers meet the FedRAMP Moderate baseline equivalency, ensuring full compliance with Department of Defense security requirements for handling Controlled Technical Information (CTI).

6. Cloud Infrastructure

GCA utilizes Microsoft Azure Government and Microsoft 365 GCC High for all cloud operations. These platforms provide enterprise-grade security with the following certifications and authorizations:

• FedRAMP High Provisional Authority to Operate (P-ATO) from the Joint Authorization Board (JAB)
• DFARS 252.204-7012 attestation confirming compliance with defense information protection requirements
• DoD Cloud Security Requirements Guide (SRG) IL4 Provisional Authorization from the Defense Information Systems Agency (DISA)
• DoD Cloud Security Requirements Guide (SRG) IL5 Provisional Authorization from the Defense Information Systems Agency (DISA)

7. Data Security

GCA implements comprehensive security measures to protect Controlled Unclassified Information (CUI), Federal Confidential Information (FCI), and Controlled Technical Information (CDI). Our systems and processes safeguard sensitive information throughout the entire business development and proposal lifecycle.

8. Third-Party Assessment

Sera-Brynn, a certified FedRAMP Third-Party Assessment Organization, conducted comprehensive compliance verification of GCA's security posture. The assessment included review and validation of:

• Information systems policies and procedures
• Corporate and application cloud architecture
• Compliance procedures and security control implementation
• Penetration testing and risk assessment

9. Continuous Improvement

GCA regularly reviews and updates all policies, procedures, and systems to maintain ongoing compliance with evolving regulatory requirements and industry best practices. Our continuous improvement program ensures that security controls remain effective and aligned with federal standards.

10. Documentation and Evidence

GCA maintains a comprehensive body of evidence (BOE) documenting our compliance with all applicable frameworks and standards. This evidence includes:

• System Security Plan (SSP) summary
• Control Implementation Summary and Customer Responsibility Matrix (CIS/CRM)
• Third-Party Assessment Organization Letters of Attestation
• Shared Responsibility Matrices for FedRAMP/NIST 800-53 control groups
• Shared Responsibility Matrices for CMMC/NIST 800-171 control groups

Clients and partners requiring access to relevant compliance documentation should contact: info@gcagov.com

11. Contact Information

Email: info@gcagov.com

Phone: 202-990-6030

Address: 1309 Coffeen Ave, Suite 11198, Sheridan, WY 82801, USA

Compliance Frameworks Summary

Cloud Infrastructure Certifications

This Compliance Statement is current as of March 9, 2026. GCA maintains and regularly updates compliance certifications. For the most current compliance status, visit gcagov.com or contact info@gcagov.com.

---