Cybersecurity Compliance and CMMC Implementation

This contract requires the implementation of NIST SP 800-171 cybersecurity controls to achieve compliance with CMMC Level 2 standards, focused on system hardening, robust access controls, and comprehensive audit logging across all relevant systems and environments. The effort is scoped to ensure the contractor meets the Department of Defense’s cybersecurity requirements for handling controlled unclassified information, with the ultimate goal of passing a formal CMMC Level 2 assessment. Work must be performed at Cherry Point, North Carolina, with all security measures aligned to federal guidelines and tailored to the specific infrastructure and operational context of the Active Devices Division. The contract is structured as a small business set-aside under SBA requirements, exclusively available to businesses classified as total small businesses as defined by FAR 19.5, and falls under NAICS code 541512 for computer systems design services. The solicitation was posted on July 20, 2026, with responses due by July 31, 2026, and all proposals must demonstrate clear expertise in NIST framework application, CMMC readiness, and defense contracting compliance. The successful vendor will be responsible for documenting control implementation, maintaining audit trails, and providing evidence of continuous compliance, all in support of securing sensitive defense-related systems at the specified location.