Cybersecurity Compliance and CMMC Assessment

The contract requires the performance of a CMMC Level 2 self-assessment, the development of a comprehensive System Security Plan, and the reporting of compliance status in the Supplier Performance Risk System in accordance with NIST SP 800-171 Rev 1 and DFARS 252.204-7012. The work is focused on ensuring cybersecurity controls are properly documented, implemented, and validated to meet Department of Defense requirements for protecting controlled unclassified information. The assessment must align with the CMMC framework’s Level 2 objectives, which include establishing a foundational cybersecurity posture through the implementation of 110 security controls specified in NIST SP 800-171. The contract is a subcontract under the Department of Defense, managed by the ASC Commodities Division, with performance required to take place in Tracy, California, at the ZIP code 95304-5000. The solicitation was posted on May 12, 2026, and responses are due by May 20, 2026. The North American Industry Classification System code is 541611, indicating the work falls under Management, Scientific, and Technical Consulting Services. The contract is not subject to a specific set-aside and is accessible through the DIBBS platform for interested respondents.