Cybersecurity and Export Control Compliance (CMMC Level 2)

This contract requires the implementation and documentation of Cybersecurity Maturity Model Certification Level 2 controls to ensure alignment with NIST SP 800-171 security requirements and adherence to DFARS 252.204-7012 for protecting controlled unclassified information within nonfederal systems. The contractor must establish and maintain a robust cybersecurity framework that addresses access control, audit, configuration management, identification and authentication, incident response, and risk assessment, all tailored to safeguard information systems handling sensitive defense-related data. Compliance must extend to the secure handling, storage, transmission, and disposal of ITAR and EAR-controlled technical data, ensuring that all processes meet federal export control obligations and prevent unauthorized access or disclosure. The contract is structured as a subcontract under a HUBZone Set-Aside designation, targeting businesses located in historically underutilized business zones to promote economic development in distressed areas. It falls under NAICS code 541512 for computer systems design services and is managed by the Department of Defense under the procurement activity Construction & Equipment Manu & Con. Performance is required at New Cumberland, Pennsylvania, 17070-5002, with responses due by August 6, 2026. The contractor must demonstrate both technical capability in cybersecurity implementation and organizational compliance with federal export regulations, ensuring full alignment with defense supply chain security mandates.