Cybersecurity Compliance and CMMC Level 2 Implementation

The contract requires implementation and maintenance of CMMC Level 2 and NIST SP 800-171 cybersecurity controls to protect covered defense information, encompassing key areas such as access control, security assessment, and timely incident reporting. The work involves performing a self-assessment to validate compliance with these standards and ensuring ongoing adherence to the framework throughout the contract period. The effort is focused on securing sensitive information within a defense environment and aligning with federal cybersecurity mandates. This is a small business set-aside subcontract under NAICS code 541512, issued by the Department of Defense's Strategic Acquisition Program Directorate, with a response deadline of August 12, 2026. The solicitation is open only to small businesses certified under the SBA’s Total Small Business Set-Aside program, and the performance location is not specified, indicating potential flexibility in execution. All compliance activities must be completed in alignment with federal requirements, and the successful contractor will be responsible for sustaining controls, documenting evidence, and responding to incidents in accordance with CMMC Level 2 and NIST SP 800-171 guidelines.