Cybersecurity Compliance & SPRS Reporting

The contract requires full adherence to CMMC Level 2 standards, encompassing the implementation and ongoing management of NIST SP 800-171 controls to secure controlled unclassified information. The contractor must perform regular self-assessments to evaluate compliance posture, document findings, and address any gaps to maintain readiness for external audits or reviews. SPRS submissions are a critical component, requiring accurate and timely reporting of assessment results within the Supplier Performance Risk System to demonstrate compliance status to the Department of Defense. All activities must be conducted in alignment with CMMC Version 2 requirements, ensuring that cybersecurity practices are not only implemented but also continuously monitored and improved. Performance is centered at Warner Robins, Georgia, with the work falling under NAICS code 541512 for computer systems design services. The contract is structured as a subcontract under the FA8571 Maintenance Contracting Afsc Pzim, part of the Department of Defense, and responses must be submitted by August 12, 2026. Compliance is non-negotiable, as failure to meet CMMC Level 2 requirements or submit accurate SPRS data could result in contract non-compliance, loss of eligibility for future work, or termination. The contractor is responsible for maintaining documented evidence of all security controls, training, and assessments to support audits and reporting obligations throughout the contract lifecycle.