Cybersecurity and Information Control Compliance (CMMC Level 2)

The contract requires the implementation and ongoing maintenance of cybersecurity controls to achieve and sustain CMMC Level 2 compliance, specifically tailored for defense subcontractors handling Controlled Unclassified Information. All technical and administrative measures must align with NIST SP 800-171 standards to ensure the protection, storage, transmission, and disposal of CUI in accordance with Department of Defense requirements. This includes deploying access controls, audit logging, media protection, configuration management, incident response, and workforce security practices, with continuous monitoring and documentation to support third-party assessments. The work is scoped under a subcontract associated with the Defense Logistics Agency, classified under NAICS code 541512 for computer systems design services. Performance activities are expected to occur at locations designated by the prime contractor, though specific geographic details are not provided. Compliance is not a one-time certification but demands sustained operational adherence through periodic reviews, remediation of findings, and adaptability to evolving CMMC guidance. Successful execution will require dedicated personnel, documented policies and procedures, and integration with the prime contractor’s broader information security program to maintain unbroken compliance throughout the contract lifecycle.