CMMC Compliance & Cybersecurity Implementation

This contract requires the implementation of NIST SP 800-171 security controls and CMMC Level 2 practices across systems that handle Controlled Unclassified Information related to contract performance, ensuring alignment with Department of Defense cybersecurity standards. The work must be performed at a designated location in Pulaski, Tennessee, with all activities focused on safeguarding CUI through technical, administrative, and physical safeguards as defined by the CMMC framework. Compliance must be demonstrated through documented policies, procedures, and operational controls that meet or exceed the requirements outlined in NIST SP 800-171 and CMMC Level 2, without the use of third-party certifications as a substitute for full implementation. The contract is classified as a subcontract and is issued under NAICS code 541512, indicating it supports computer systems design and related services. The solicitation was posted on June 25, 2026, with a response deadline of June 30, 2026, requiring proposers to submit comprehensive technical and compliance plans that address the full scope of required controls. The contracting activity originates from the Maritime Supply Chain ESOC Buys office within the Department of Defense, reinforcing the critical nature of securing CUI in defense-related supply chain operations. All deliverables must ensure continuous compliance, with no provision for post-award remediation unless explicitly authorized under the terms of the agreement.