Cybersecurity & CUI Safeguarding (CMMC Level 2)

The contract entails the implementation of NIST SP 800-171 controls to safeguard Covered Defense Information and ensure compliance with CMMC Level 2 requirements for all systems handling sensitive contract data. This effort is critical for meeting federal cybersecurity standards and maintaining the integrity of defense-related information throughout the supply chain. The work must be performed under a Total Small Business Set-Aside, ensuring eligibility and participation by small businesses as defined by SBA guidelines and FAR 19.5, with the NAICS code 541512 indicating information technology services as the primary scope. The contract is issued by the Department of Defense under the ASC SUPPLIER OPER OEM DIVISION and is classified as a subcontract, meaning it will support a larger prime contract or program. Responses are due by July 20, 2026, with the solicitation posted on July 15, 2026, providing a brief five-day window for submission. Performance location details are unspecified, but the technical requirements mandate full adherence to CMMC Level 2 controls, including access control, audit, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. Successful performance requires documented policies, procedures, and technical controls aligned with NIST standards and ongoing compliance validation.