Cybersecurity Compliance & CMMC Level 2 Assessment Support

The contract seeks support for implementing NIST SP 800-171 requirements and preparing for a CMMC Level 2 self-assessment, focusing on securing Controlled Unclassified Information through comprehensive documentation, system hardening, and audit readiness activities. Contractors must ensure all technical and procedural controls are in place to meet federal cybersecurity standards for handling CUI, including policy development, configuration management, access control enforcement, and continuous monitoring practices aligned with CMMC Level 2 criteria. The effort is targeted at enabling full compliance prior to assessment and maintaining audit trails that demonstrate consistent adherence to the framework. The work is to be performed at Fort Eustis, Virginia, under a subcontract arrangement tied to the Department of Defense’s Maritime Supply Chain ESOC Buys initiative. The solicitation falls under NAICS code 541512 for Computer Systems Design Services, indicating a need for technical expertise in cybersecurity architecture and compliance engineering. Interested parties must submit proposals by August 10, 2026, and are expected to demonstrate proven experience in federal cyber compliance programs, particularly with CMMC and NIST 800-171 implementation in defense contractor environments. While no set-aside information is provided, the contract is open to qualified subcontractors capable of delivering end-to-end assessment preparation and documentation tailored to DoD expectations.