Cybersecurity Compliance & CMMC Implementation

The contract requires full implementation of NIST SP 800-171 security controls across all systems handling Covered Defense Information to meet the Cybersecurity Maturity Model Certification requirements. This includes establishing audit-ready infrastructure, documenting compliance processes, and ensuring continuous monitoring and reporting capabilities. All systems must be configured to meet the baseline security standards specified in NIST SP 800-171 and demonstrate alignment with the applicable CMMC level, with emphasis on maintaining documentation, training personnel, and enforcing access controls. The contractor is responsible for preparing for and sustaining audit readiness through structured evidence collection, incident response procedures, and timely reporting of cybersecurity incidents involving CDI. Compliance must be achieved and maintained throughout the contract lifecycle, with validation expected through third-party assessments. The effort is scoped to support Department of Defense operations at the DDSP New Cumberland Facility under a subcontract arrangement, with a response deadline in July 2026 and a NAICS code indicating it falls under computer systems design services.