Cybersecurity Compliance and CMMC Self-Assessment

The contract requires the performance of a Cybersecurity Maturity Model Certification (CMMC) Level 2 self-assessment to validate compliance with NIST SP 800-171 requirements for protecting controlled unclassified information. This includes implementing and documenting security controls across systems that handle such information, ensuring alignment with federal standards for cybersecurity posture. The contractor must establish processes for identifying, reporting, and responding to cybersecurity incidents in accordance with DFARS contractual clauses, maintaining full traceability and accountability for compliance activities. The work is solicited as a subcontract under NAICS code 541512, tied to the Department of Defense organization LSO COMBAT VEHICLES AND ARMAMENT, with performance required at the location in New Cumberland, PA, ZIP 17070-5002. The solicitation was posted on July 16, 2026, and responses are due by July 27, 2026. While no set-aside type is designated, the effort centers exclusively on achieving and demonstrating CMMC Level 2 readiness without third-party assessment, placing full responsibility on the contractor for self-validation, documentation, and reporting readiness to meet DOD cybersecurity expectations.