Cybersecurity and CMMC Level 2 Compliance Support

The contract requires implementation of NIST SP 800-171 cybersecurity controls to secure controlled unclassified information within federal systems, with full alignment to CMMC Level 2 requirements to validate compliance through an official assessment. The contractor must establish, document, and maintain all necessary policies, procedures, and technical safeguards across the organization’s information systems to meet the baseline standards for access control, awareness training, audit and accountability, configuration management, identification and authentication, and incident response. The scope further mandates adherence to DFARS 252.204-7012, ensuring timely reporting of any cyber incidents affecting covered defense information or the contractor’s internal systems, including coordination with the DoD and submission of required forensic data as stipulated by regulation. Performance is expected to take place in Tampa, Florida, with all compliance activities centered on securing systems handling sensitive defense-related data. The subcontract is issued under NAICS code 541512 for computer systems design services and is part of the Department of Defense’s broader initiative to fortify its supply chain against cyber threats. All deliverables must be completed prior to the response deadline of August 4, 2026, with full readiness for assessment and reporting mechanisms in place by the time of contract award and execution. Compliance with these requirements is critical to maintaining eligibility for future DoD contracts and sustaining access to protected information within the defense industrial base.