Cybersecurity Compliance and CMMC Support

The contract requires the vendor to perform a Cybersecurity Maturity Model Certification (CMMC) Level 2 self-assessment and ensure full compliance with the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, including implementation of all NIST Special Publication 800-171 security controls. The work involves assessing the organization’s current cybersecurity posture, identifying gaps against the required controls, and developing a comprehensive incident reporting plan to meet federal standards for protecting controlled unclassified information. The vendor must demonstrate the ability to conduct an accurate, thorough, and documented evaluation of systems and processes supporting covered defense information. This subcontract is a total small business set-aside under SBA guidelines, meaning only small businesses qualify to respond, and it is tied to the NAICS code 541512 for computer systems design services. The place of performance is in Tracy, California, with a zip code of 95304-5000. The solicitation was posted on July 24, 2026, with a response deadline of July 29, 2026, and is managed by the Department of Defense under the Maritime Supply Chain organization. The vendor is expected to deliver a fully substantiated compliance package that can withstand federal audit and verification processes.