Cybersecurity Compliance and CMMC Implementation

The contract requires the implementation of NIST SP 800-171 security controls across the prime contractor’s information systems that handle controlled unclassified information, with the ultimate goal of achieving CMMC Level 2 certification. This effort involves a comprehensive assessment, documentation, and operationalization of cybersecurity practices to meet federal requirements for safeguarding sensitive defense data. The contractor must demonstrate full compliance with all applicable controls, establish continuous monitoring, and prepare for an independent third-party assessment certifying CMMC Level 2 readiness. This subcontract is a total small business set-aside under the SBA program, exclusively available to small businesses classified under NAICS code 541512 for computer systems design services. The work is performance-based at the location in New Cumberland, Pennsylvania, with a response deadline of August 12, 2026. The contracting activity falls under the Department of Defense, specifically the ASC SUPPLIER OPER AE AND AF DIV, and the task is tied directly to securing information systems critical to national defense supply chain integrity. Successful performance will validate the contractor’s ability to meet evolving cybersecurity standards and support long-term DoD compliance objectives.