Cybersecurity Compliance and CUI Protection (CMMC Level 2)

The contract requires the implementation and documentation of cybersecurity controls to safeguard Controlled Unclassified Information in accordance with NIST Special Publication 800-171 and CMMC Level 2 standards. This subcontract focuses on ensuring full compliance with these frameworks through the establishment of technical, administrative, and physical safeguards tailored to protect CUI across all systems and processes. The work must be thoroughly documented to demonstrate adherence to all required controls, including access management, audit logging, incident response, and system integrity measures, with an emphasis on continuous monitoring and risk mitigation. Performance of the contract is centered at New Cumberland, Pennsylvania, with an expected completion timeline aligned to the response deadline of May 20, 2026. The solicitation falls under NAICS code 541512, indicating it is related to computer systems design services, and is issued under the Department of Defense through the ASC SUPPLIER OPER OEM DIVISION. While no set-aside type is specified, bidders must be prepared to meet stringent CMMC Level 2 certification requirements, which involve third-party assessment as part of compliance validation. The contractor is expected to deliver not only operational security controls but also auditable records, policies, procedures, and training documentation to support sustained compliance without interruption.