CMMC Level 2 Cybersecurity Assessment and Safeguarding

The contract requires the implementation of all NIST SP 800-171 security controls to protect Controlled Unclassified Information (CUI) on systems and networks, ensuring comprehensive cybersecurity safeguards across the entire operational environment. The contractor must achieve CMMC Level 2 certification through an official assessment conducted by a C3PAO, demonstrating compliance with both the NIST standards and additional CMMC requirements related to process maturity and documentation. This includes establishing robust policies, continuous monitoring, incident response capabilities, and employee training programs to meet federal cybersecurity expectations for handling sensitive unclassified data. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside category with a NAICS code of 541512, indicating it is targeted toward information technology services. The obligation is managed by the Department of Defense’s Strategic Acquisition Program Directorate and must be responded to by August 18, 2026. Performance will occur within the DoD’s operational framework, with no specific location designated, implying work may be conducted remotely or at multiple secure facilities. Continuous compliance is mandatory beyond certification, requiring ongoing audits, control updates, and readiness for re-assessment to maintain CMMC Level 2 status and safeguard CUI indefinitely.