Cybersecurity Compliance and Incident Response

This contract requires the implementation of CMMC Level 2 and NIST SP 800-171 cybersecurity controls to ensure compliance with Department of Defense standards for handling controlled unclassified information. The contractor must conduct thorough self-assessments to validate adherence to these controls and establish a robust incident response capability that includes reporting incidents via DIBNET. A critical requirement is the preservation of forensic data for a minimum of 90 days following any cybersecurity incident to support investigation and remediation efforts. The work is targeted toward a small business set-aside under the SBA’s Total Small Business Set-Aside program, and the NAICS code 541512 indicates the scope involves computer systems design and related services. Performance is to be carried out at a location in Anniston, Alabama, with responses due by August 14, 2026, under a subcontract structure awarded by the Department of Defense through its Land Supplier Operations Vehicle Support office.