Cybersecurity & CUI Safeguarding (CMMC Level 2)

The contract requires the implementation and ongoing maintenance of comprehensive cybersecurity controls to safeguard Controlled Unclassified Information (CUI) associated with the award, specificallyaligned with the Cybersecurity Maturity Model Certification (CMMC) Level 2 requirements. This includes conducting a self-assessment to demonstrate compliance with the specified control family standards, ensuring that all systems and processes handling CUI are secured against unauthorized access, disclosure, or compromise. The contractor must establish, document, and sustain practices that meet CMMC Level 2 benchmarks, which encompass both technical and administrative safeguards across areas such as access control, audit and accountability, configuration management, and incident response. Performance of this work is centered at New Cumberland, Pennsylvania, with a response deadline of August 12, 2026, and the contract is classified as a subcontract under the NAICS code 541512 for computer systems design services. The acquiring entity is the ASC Commodities Division within the Department of Defense, and adherence to CMMC Level 2 standards is non-negotiable, forming the foundation for contractor eligibility and continued participation. No set-aside designation is specified, and all compliance obligations must be fulfilled without reliance on external documentation or third-party certifications at the time of bid submission, though future audits may require verification of self-assessment outcomes.