Cybersecurity Compliance and CMMC Support

The contract requires implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard covered defense information, with full alignment to CMMC Level 2 requirements. This includes establishing technical, administrative, and physical safeguards to ensure confidentiality, integrity, and availability of controlled unclassified information across all systems and environments. The contractor must demonstrate continuous compliance through documented policies, employee training, asset management, access controls, and audit readiness, all aligned with the CMMC framework’s rigorous standards. The contractor is also responsible for managing cyber incident reporting procedures, ensuring timely detection, containment, mitigation, and reporting of any security events involving covered defense information in accordance with DFARS and CMMC guidelines. This includes maintaining incident response plans, coordinating with relevant government entities, and preserving forensic evidence for investigation. The work is scoped as a subcontract under the Department of Defense, categorized under NAICS code 541512 for computer systems design services, with a response deadline of July 24, 2026, and performance expected to support the ASC Commodities Division’s mission-critical cybersecurity posture.