Cybersecurity Compliance and CMMC Level 2 Assessment

The contract requires implementation of all NIST SP 800-171 security controls to safeguard covered defense information and to position the contractor for a CMMC Level 2 self-assessment. This involves establishing, documenting, and maintaining a comprehensive cybersecurity program aligned with the NIST framework, including access control, audit and accountability, configuration management, incident response, and system and communications protection. The effort must ensure full compliance with all 110 controls outlined in NIST SP 800-171 Revision 2 and prepare detailed documentation to support the self-assessment process required for CMMC Level 2 certification. The work is scoped as a subcontract under the Department of Defense, with performance located in Tracy, California, 95304-5000. The North American Industry Classification System code is 541512, indicating it relates to computer systems design and related services. The solicitation was posted on July 23, 2026, with responses due by August 3, 2026, and is managed through the DIBBS system under reference SPE8E926T3246. All activities must be completed to meet federal requirements for handling sensitive defense information and to demonstrate readiness for CMMC Level 2 evaluation without external audit at this stage.