Cybersecurity Compliance (CMMC & NIST SP 800-171)

The contract requires the performance of a CMMC Level 2 self-assessment to ensure full compliance with NIST SP 800-171 standards for protecting covered defense information. This effort is critical for meeting cybersecurity requirements mandated by the Department of Defense and involves evaluating current security controls, identifying gaps, and implementing necessary improvements to achieve and maintain compliance. The work must be completed under the terms of a subcontract and is classified under SBA set-aside eligibility, indicating a focus on small business participation. The contract is associated with the NAICS code 541612 and will be performed at Tinker Air Force Base, Oklahoma, with a response deadline of July 16, 2026. The contracting activity is managed by the ASC SUPPLIER OPER OEM DIVISION within the Department of Defense, and all deliverables must align with the federal cybersecurity framework specified in NIST SP 800-171. The self-assessment must be thorough and documented to demonstrate adherence to all 110 security controls, enabling the contractor to attain CMMC Level 2 certification as a prerequisite for continued participation in defense-related work.