Cybersecurity Compliance and CMMC Level 2 Implementation

The contract requires the implementation and ongoing maintenance of Cybersecurity Maturity Model Certification (CMMC) Level 2 controls to safeguard Controlled Unclassified Information (CUI) throughout all phases of design, production, and delivery. This subcontract is focused on ensuring robust cybersecurity practices are embedded into systems and processes to meet federal requirements for protecting sensitive but unclassified data. The work must be performed at Tinker Air Force Base with a zip code of 73145-9031, and the contractor is expected to align with the National Institute of Standards and Technology (NIST) SP 800-171 standards as the baseline for CMMC Level 2 compliance. The solicitation is issued under NAICS code 541512 for Computer Systems Design Services and is managed by the ASC SUPPLIER OPER OEM DIVISION within the Department of Defense. Responses must be submitted by July 29, 2026, with the solicitation posted on July 21, 2026, providing a limited window for interested parties to prepare and submit proposals. The contract does not specify any set-aside status or eligibility constraints, meaning it is open to all qualified offerors. Compliance with CMMC Level 2 controls is non-negotiable and must be sustained over time, requiring not only initial implementation but also continuous monitoring, audit readiness, documentation, and incident response capabilities. The place of performance is fixed at Tinker AFB, and the subcontractor must be prepared to integrate with existing DoD infrastructure and adhere to all security protocols governing operations at this location.