Cybersecurity & CMMC Compliance Implementation

The contract requires the implementation and documentation of CMMC Level 2 and NIST SP 800-171 compliance measures to safeguard Controlled Unclassified Information within a defense-related environment. This includes conducting a thorough system assessment to identify gaps in current cybersecurity controls, developing and formalizing comprehensive security policies and procedures aligned with federal standards, and establishing robust incident reporting protocols to ensure timely response and recovery in the event of a breach. The scope demands end-to-end documentation to demonstrate full adherence to regulatory requirements and readiness for third-party assessments. The work must be performed at the designated place of performance in New Cumberland, Pennsylvania, with a submission deadline of August 3, 2026. This is a subcontract under the Department of Defense, specifically tied to the Nuclear Reactor Program, and falls under NAICS code 541512 for computer systems design services. All efforts must align with the rigorous compliance obligations of federal contractors handling sensitive defense information, ensuring that technical, administrative, and physical controls are not only implemented but also continuously monitored and maintained to sustain CMMC Level 2 certification.