Cybersecurity Compliance & CMMC Level 2 Implementation

The contract requires the development and ongoing maintenance of a System Security Plan aligned with NIST SP 800-171 standards, including a thorough assessment of all required security controls to ensure compliance with federal cybersecurity requirements. In addition, the contractor must conduct a self-assessment for CMMC Level 2 certification, verifying that the organization’s cybersecurity practices and policies meet the necessary maturity and capability thresholds as defined by the Cybersecurity Maturity Model Certification program. This work is performed in support of a prime contractor under a subcontract arrangement, with the primary focus on securing Controlled Unclassified Information within the supply chain. Performance of all tasks must be completed and delivered by the response deadline of May 20, 2026, with the place of performance designated as New Cumberland, Pennsylvania, ZIP 17070-5002. The effort falls under NAICS code 541512 for Computer Systems Design Services, indicating that the work involves technical design and implementation of cybersecurity systems rather than manufacturing or general IT operations. The contracting activity is managed by the Department of Defense through its ASC SUPPLIER OPER OEM DIVISION, and the contract is structured under a subcontract mechanism, meaning the successful bidder will provide services directly to the prime contractor rather than the government agency itself.