CMMC Level 2 Cybersecurity Compliance

The contract seeks a small business to implement and conduct a self-assessment for CMMC Level 2 compliance, ensuring alignment with NIST SP 800-171 standards and adherence to DFARS 252.204-7008 requirements. This includes developing a comprehensive System Security Plan that outlines policies, procedures, and controls necessary to protect controlled unclassified information within the organization’s information systems. The work requires a thorough understanding of federal cybersecurity frameworks and the ability to document and validate compliance through internal assessments and evidence collection. The effort is structured as a small business set-aside under SBA regulations, with the North American Industry Classification System code 541512 indicating it relates to computer systems design services. Performance of the contract is expected to be conducted under the purview of the Department of Defense’s Strategic Acquisition Program Directorate. Interested parties must respond by the deadline of July 28, 2026, and all activities must be executed in a manner that supports the defense acquisition mission, emphasizing rigorous security posture and regulatory accountability without reliance on external compliance verification beyond the provided self-assessment framework.