Cybersecurity and CMMC Compliance Support

The contract seeks a small business to implement and maintain cybersecurity controls to protect covered defense information in alignment with CMMC Level 2 requirements, ensuring adherence to federal standards for safeguarding sensitive data within the defense supply chain. This subcontract involves ongoing support for configuration, monitoring, and updating of security measures as well as timely detection, reporting, and response to cybersecurity incidents affecting covered information systems. Compliance with CMMC Level 2 mandates the integration of practices across access control, audit and accountability, personnel security, and system and communications protection, among other domains, to meet the Department of Defense’s baseline for third-party contractors handling controlled unclassified information. The opportunity is designated as a Total Small Business Set-Aside under SBA regulations, restricting eligibility exclusively to small businesses certified under the SBA’s size standards for NAICS code 541512, which covers computer systems design and related services. The solicitation was posted on July 28, 2026, with responses due by August 5, 2026, and performance will support the ASC Supplier Operations AE and AF Division within the Department of Defense. While specific location details for performance are not provided, the contractor must be prepared to support operations in alignment with DOD-wide cybersecurity infrastructure requirements and incident reporting protocols as directed by applicable federal regulations.