Cybersecurity Compliance & CUI Protection (NIST SP 800-171 / CMMC Level 2)

The contract requires the implementation and ongoing maintenance of cybersecurity controls to safeguard Controlled Unclassified Information (CUI) within contractor information systems, specifically aligned with NIST SP 800-171 standards and DFARS requirements. A comprehensive System Security Plan (SSP) must be developed and maintained to document how security controls are applied, assessed, and monitored to ensure continuous compliance. The scope encompasses all technical, administrative, and physical safeguards necessary to protect CUI from unauthorized access, disclosure, or compromise, with an explicit focus on achieving CMMC Level 2 maturity. This subcontract is issued by the ASC Commodities Division under the Department of Defense and is performance-based with a place of performance located in New Cumberland, Pennsylvania, ZIP code 17070-5002. The solicitation, identified under NAICS code 541512, requires a response by May 21, 2026, and emphasizes strict adherence to federal cybersecurity frameworks that govern the handling of sensitive but unclassified government data. Contractors must demonstrate proven capability in deploying and sustaining NIST-aligned controls, conducting regular assessments, and maintaining documentation to validate compliance throughout the lifecycle of the agreement.