Cybersecurity Compliance and CMMC Level 2 Implementation

The contract requires full implementation of the cybersecurity controls outlined in NIST Special Publication 800-171 to protect controlled unclassified information within the contractor’s systems. This includes establishing policies, procedures, and technical safeguards aligned with the framework to ensure compliance with federal security standards. In addition to implementation, the contractor must prepare for and successfully undergo a formal Cybersecurity Maturity Model Certification Level 2 assessment conducted by an accredited third-party assessment organization to validate the effectiveness of the implemented controls. The effort must encompass all relevant domains including access control, audit and accountability, configuration management, and incident response. Ongoing compliance includes maintaining strict adherence to the Defense Federal Acquisition Regulation Supplement clause 252.204-7012, which mandates timely reporting of cyber incidents affecting covered defense information or the contractor’s internal network. All incidents must be reported to the Department of Defense within 72 hours of discovery, with required documentation submitted through the DOD Cyber Incident Reporting portal. The contractor is responsible for sustaining these practices beyond assessment completion, ensuring continuous compliance and readiness for future audits or inspections. This subcontract is classified under NAICS code 541512 and is issued by the Department of Defense under the LSO Combat Vehicles and Armament organization.