CMMC Level 2 Self-Assessment and CDI Safeguarding

The contract requires the performance of a CMMC Level 2 self-assessment and the implementation of NIST SP 800-171 controls to safeguard Covered Defense Information and ensure compliance with cyber incident reporting obligations. This subcontract is intended for organizations capable of assessing their current cybersecurity posture against the CMMC Level 2 requirements and executing necessary technical and procedural controls to meet federal defense cybersecurity standards. The work must be performed at the designated place of performance in Virginia Beach, Virginia, with a deadline for responses set for July 28, 2026. The solicitation falls under NAICS code 541512, categorizing it within computer systems design services, and is managed by the Department of Defense through its Aviation Supply Chain office. All activities must be completed in alignment with the Defense Industrial Base’s cybersecurity framework to protect sensitive information and maintain readiness for future contractual obligations.