CMMC Compliance Implementation & Maintenance

The contract requires the implementation and ongoing maintenance of Cybersecurity Maturity Model Certification (CMMC) compliance for systems that handle Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). This includes conducting NIST SP 800-171 self-assessments, managing Plans of Action and Milestones (POA&M), and submitting required scores to the Supplier Performance Risk System (SPRS) to demonstrate compliance status. All activities must align with CMMC standards to ensure the secure handling, storage, and transmission of sensitive government data. The work is scoped to support systems located at the Crane, Indiana site, with performance tied to federal defense cybersecurity requirements. This is a subcontract under the Department of Defense, specifically managed by NSWC Crane, with a North American Industry Classification System code of 541611 for scientific and technical consulting services. The opportunity was posted on June 25, 2026, and responses are due by July 7, 2026, at 8:00 PM Eastern Time. While no set-aside designation is specified, the work is critical for maintaining defense contract eligibility and requires demonstrated expertise in CMMC frameworks, risk assessment, and compliance documentation. Performance must be completed in accordance with federal standards without deviations, and ongoing adherence to CMMC controls will be necessary beyond initial implementation.