Cybersecurity & CUI Safeguarding (CMMC Level 2)

The contract requires implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) across all applicable systems and processes. This includes developing and maintaining comprehensive system security plans that document how required controls are applied, monitored, and enforced. A full CMMC Level 2 self-assessment must be conducted and documented to demonstrate compliance with the Cybersecurity Maturity Model Certification framework, ensuring the organization meets the baseline for protecting CUI in accordance with federal standards. The work is tied to a subcontract under the Department of Defense, specifically managed by the ASC Commodities Division, with performance required at New Cumberland, Pennsylvania, 17070-5002. The solicitation is set aside for small businesses under SBA guidelines and falls under NAICS code 541512 for computer systems design services. Proposals are due by July 14, 2026, with the opportunity posted on July 6, 2026. Compliance with all cybersecurity requirements is mandatory and must be verifiable through documented evidence, including policies, procedures, training records, and assessment results. Failure to meet CMMC Level 2 standards or to sustain system security plans will result in non-compliance, potentially leading to contract termination or financial penalties. All activities must align with federal cybersecurity mandates and be conducted in a manner that ensures continuous protection of sensitive government data.