Cybersecurity and CUI Protection (CMMC Level 2)

The contract requires the implementation and maintenance of comprehensive cybersecurity controls to safeguard Controlled Unclassified Information (CUI) in alignment with the Cybersecurity Maturity Model Certification (CMMC) Level 2 standards and the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. This subcontract is focused on ensuring all systems, processes, and personnel handling CUI meet rigorous security requirements to prevent unauthorized access, disclosure, or compromise, with the place of performance located in New Cumberland, Pennsylvania, under the oversight of the Department of Defense’s ASC Commodities Division. The solicitation was posted on July 21, 2026, with a response deadline of July 29, 2026, and falls under the NAICS code 541512 for Computer Systems Design Services. All work must adhere strictly to CMMC Level 2 practices, which include both technical and administrative controls such as access management, audit logging, incident response, and data encryption. The contractor is expected to demonstrate compliance through documentation, assessments, and ongoing monitoring, and must be prepared to support DOD audit readiness at all times. While the contract does not specify a set-aside category or point of contact, failure to meet these security requirements will result in non-compliance and potential termination of the agreement.