CMMC Level 2 Compliance Assessment and System Security Plan (SSP) Development

The contract requires a comprehensive compliance assessment against NIST SP 800-171 Rev 1 to evaluate the current security posture of a system handling controlled unclassified information. The scope includes identifying gaps in existing security controls, determining areas where requirements are not met, and developing a fully compliant System Security Plan that documents policies, procedures, and implementation strategies to address all identified deficiencies. The final deliverable must be submitted to the Supplier Performance Risk System for official record and validation. The work is to be performed at Robins Air Force Base, Georgia, under a subcontract issued by the Department of Defense’s ASC Supplier Oper OEM Division. The effort must align with CMMC Level 2 requirements, ensuring adherence to federal standards for cybersecurity protection. The proposal response deadline is set for May 19, 2026, with the solicitation posted on May 11, 2026. The North American Industry Classification System code for this effort is 541611, which categorizes it under management, scientific, and technical consulting services. Successful completion will result in a formal, audit-ready SSP that meets all criteria for government submission and compliance verification.