Cybersecurity Compliance & CUI Protection

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within the recipient’s systems and operations, ensuring compliance with Department of Defense cybersecurity standards. The work is specifically aimed at supporting a CMMC Level 2 self-assessment, which involves documenting, testing, and validating the effectiveness of security practices to meet the mandatory requirements for handling CUI in support of DoD contracts. All activities must be conducted in alignment with federal cybersecurity frameworks and tailored to the operational environment at the designated place of performance in Cherry Point, North Carolina, with full accountability for protecting CUI throughout its lifecycle. This is a subcontract under the Department of Defense’s ASC Commodities Division, classified under NAICS code 541512 for computer systems design services. The solicitation was posted on August 5, 2026, with a response deadline of August 13, 2026, indicating a tight turnaround for proposals. The contract does not specify any set-aside status, and performance is expected to be carried out entirely at the Cherry Point location with a ZIP code of 28533-5040. While no point of contact is listed, the official interface for submissions and inquiries is through the DIBBS portal. Successful performance will require a documented cyber hygiene program, regular audits, continuous monitoring of controls, and readiness for internal and potential external assessments to validate CMMC Level 2 compliance.