Controlled Unclassified Information (CUI) Cybersecurity and CMMC Compliance

The contract seeks support for achieving CMMC Level 2 compliance for systems that handle Controlled Unclassified Information, with a focus on self-assessment, SPRS registration, and the development and management of a Plan of Action and Milestones. It requires implementation of all NIST SP 800-171 security controls to ensure proper safeguarding of CUI, covering technical, operational, and administrative measures aligned with federal cybersecurity standards. The effort is intended to bridge compliance gaps and establish a sustainable cybersecurity posture under the CMMC framework, specifically tailored to Department of Defense requirements. This subcontract is issued under NAICS code 541512 for Computer Systems Design Services and is associated with NSWC Crane, a branch of the Department of Defense. The solicitation was posted on April 28, 2026, with a response deadline of May 7, 2026. Although no set-aside type is specified, the work is expected to be performed in support of government systems requiring rigorous cybersecurity adherence. The contractor must deliver a complete compliance package that enables the government entity to demonstrate readiness for CMMC Level 2 assessment, including documented processes, evidence of control implementation, and ongoing remediation tracking through the POAM.