Cybersecurity & CMMC Compliance Management

The contract requires the implementation and ongoing maintenance of CMMC Level 2 compliance for systems that process, store, or transmit Controlled Unclassified Information, ensuring all cybersecurity controls are properly documented, enforced, and validated through formal audits. This includes developing and updating security policies, conducting risk assessments, configuring technical safeguards, and preparing for third-party assessments to meet the Department of Defense's cybersecurity requirements. The work is scoped to support systems under the Navsup Weapon Systems Support division, with performance obligations tied to the full scope of CMMC Level 2 controls as defined by the Cybersecurity Maturity Model Certification framework. The subcontract is solicited under NAICS code 541512 for Computer Systems Design Services and is open for response until June 2, 2026. While no specific location is listed for performance, the work must align with the operational needs of the Department of Defense and be executed in compliance with federal cybersecurity standards. Contractors must demonstrate capability in managing end-to-end compliance processes, from initial gap analysis through to sustained adherence, with emphasis on documentation rigor, remediation of vulnerabilities, and readiness for external audits. There is no set-aside designation indicated, and the contract is intended for a qualified subcontractor capable of delivering certified cybersecurity services to defense contractors handling sensitive data.