Cybersecurity Compliance and Reporting (NIST SP 800-171)

The contract requires the development and submission of a System Security Plan aligned with NIST SP 800-171 to safeguard Controlled Unclassified Information, along with the execution of a CMMC Level 2 Self-Assessment to validate compliance with federal cybersecurity standards. This effort is essential for ensuring that systems handling CUI meet the required security controls and are prepared for potential third-party evaluations under the Cybersecurity Maturity Model Certification program. The work is tied to a subcontract under the Department of Defense, specifically managed by the ASC SUPPLIER OPER OEM DIVISION, with performance expected to occur in New Cumberland, Pennsylvania, at ZIP code 17070-5002. The solicitation, identified under NAICS code 541611 for Management, Scientific, and Technical Consulting Services, was posted on May 12, 2026, with a firm response deadline of May 20, 2026. This is not a government-wide acquisition but a subcontract opportunity, and no set-aside provisions are specified. The contractor must deliver a comprehensive SSP that documents all security controls and processes relevant to CUI protection, followed by a rigorous self-assessment that accurately reflects the organization’s current compliance posture under CMMC Level 2 requirements. The successful proposer will be expected to demonstrate a clear understanding of NIST SP 800-171 controls and the ability to implement and maintain them within a DOD supply chain environment.