CMMC Compliance and System Security Planning

The contract requires the development of a System Security Plan aligned with NIST SP 800-171 Rev 1 controls, alongside the execution of a CMMC Level 2 self-assessment and subsequent submission to the Supplier Performance Risk System. The work must fully comply with the security requirements outlined in NIST SP 800-171, ensuring all applicable controls are documented, implemented, and verified as part of the SSP. The self-assessment must be conducted rigorously to accurately reflect the organization’s current cybersecurity posture and identify any gaps prior to submission. The deliverables are intended to support the Department of Defense’s supply chain security objectives by validating compliance with CMMC Level 2 standards, which include safeguarding controlled unclassified information across federal contracts. This subcontract is issued under the NAICS code 541512 and is part of the ASC SUPPLIER OPER OEM DIVISION’s efforts to ensure its vendor ecosystem meets required cybersecurity maturity levels. The solicitation was posted on May 10, 2026, with a response deadline of May 18, 2026, indicating a tight turnaround for proposers to demonstrate expertise in both documentation and technical compliance. All work must be completed in accordance with federal cybersecurity guidelines and submitted through the designated SPRS portal, with no set-aside provisions specified. The place of performance and point of contact details are not provided, implying flexibility in execution location as long as deliverables meet the specified standards and timelines.