Cybersecurity Compliance and CMMC Level 2 Assessment Support

The contract requires the implementation of all NIST SP 800-171 security controls to protect controlled unclassified information within federal systems, ensuring alignment with federal cybersecurity standards. It further demands full support for achieving CMMC Level 2 certification, which includes documenting policies, conducting internal assessments, remediating gaps, and preparing for an official third-party evaluation to verify compliance with both NIST controls and CMMC maturity requirements. The contractor must also establish and maintain robust processes to enable cyber incident reporting within 72 hours of discovery, as mandated by DFARS 252.204-7012, including detection, analysis, containment, and notification procedures that meet Department of Defense specifications. Performance is tied to Tinker Air Force Base, with the work falling under NAICS code 541512 for computer systems design services. The contract is structured as a subcontract under the Department of Defense’s Land Supply Chain initiative, and responses must be submitted by August 7, 2026. While no set-aside status is specified, the requirement emphasizes compliance with stringent federal cybersecurity frameworks and the ability to support defense supply chain security objectives through technical implementation, documentation, and operational readiness for incident response.