Cybersecurity Compliance and SPRS Reporting

The contract requires the implementation and ongoing maintenance of CMMC Level 2 compliance across all relevant systems and processes, ensuring alignment with the cybersecurity standards mandated for defense contractors. This includes conducting a thorough assessment against the NIST SP 800-171 framework to identify gaps, apply necessary controls, and document remediation efforts. All findings from the assessment must be formally reported and submitted to the Supplier Performance Risk System (SPRS) to meet federal reporting obligations and maintain an active, compliant status in the defense supply chain. The contractor must also ensure continuous audit readiness, meaning systems, policies, and documentation must be consistently maintained in a state that can support unannounced or scheduled audits by federal stakeholders or third-party assessors. The work is structured as a subcontract under the Defense Logistics Agency, part of the Department of Defense, and falls under NAICS code 541512 for computer systems design services. The obligation is tied to the contract SPE8E626P1085 and requires adherence to strict timelines and procedural accuracy to satisfy DoD cybersecurity requirements. There is no set-aside designation specified, indicating the opportunity is open to all qualified entities, and performance is expected to be conducted without geographic restrictions as no specific place of performance is identified. The emphasis is on sustained compliance, not a one-time evaluation, requiring active monitoring, updates, and documentation to retain validity over the life of the contract.