Cybersecurity Compliance (CMMC & NIST SP 800-171)

The contract requires the successful bidder to conduct a CMMC Level 2 self-assessment and ensure full compliance with NIST SP 800-171 standards to protect Controlled Unclassified Information (CUI) generated or handled in support of contract performance. This involves evaluating existing cybersecurity controls, implementing necessary safeguards, and documenting compliance across all relevant systems and processes to meet the requirements for handling CUI within the Department of Defense supply chain. The work is tied to a subcontract under the Maritime Supply Chain organization and must be performed at Tinker AFB with a zip code of 73145-8000. The solicitation was posted on August 2, 2026, with a response deadline of August 13, 2026, indicating a tight turnaround for submission. The North American Industry Classification System code 541512 applies, reflecting involvement in computer systems design and related services. The effort is not subject to a specific set-aside classification, and all compliance activities must be completed to enable the contractor to legally and securely process, store, and transmit CUI as part of the defense contract lifecycle. Failure to achieve and maintain CMMC Level 2 readiness will result in non-compliance and potential contract termination.