Cybersecurity Compliance & Reporting (CUI Safeguarding)

The contract requires full implementation and self-attestation of Cybersecurity Maturity Model Certification (CMMC) Level 2 controls to ensure the protection of Controlled Unclassified Information in accordance with NIST Special Publication 800-171 requirements. This includes establishing, documenting, and maintaining the necessary security practices and procedures across all systems handling CUI, as well as ensuring continuous compliance through internal assessments and formal self-attestation. Compliance must be demonstrated prior to contract award and maintained throughout the performance period, with no third-party validation required for attestation. The contractor is also obligated to promptly report any cyber incidents affecting CUI to the appropriate Defense Industrial Base (DIB) portal in line with federal guidelines, ensuring timely notification, containment, and remediation activities. This subcontract is set aside entirely for small businesses under the SBA’s Total Small Business Set-Aside authority and is governed under NAICS code 541512 for computer systems design services. The solicitation deadline is August 20, 2026, and performance will be conducted in support of the Department of Defense’s Strategic Acquisition Program Directorate, with all activities tied to securing sensitive government information within a federally mandated cybersecurity framework.