Cybersecurity Compliance (CMMC) and SPRS Management

This contract establishes an ongoing requirement for comprehensive cybersecurity compliance management under the Cybersecurity Maturity Model Certification (CMMC) framework, with specific responsibilities including SPRS registration, Plan of Action and Milestones (POA&M) tracking, and rigorous verification of subcontractor adherence to CMMC standards. The work is scoped to ensure continuous alignment with Department of Defense cybersecurity mandates, focusing on maintaining documented evidence of compliance and mitigating risks across the supply chain. All activities must be conducted in accordance with federal guidelines and must remain current throughout the performance period to support the prime contractor’s eligibility for DoD contracts requiring CMMC certification. The contract is categorized as a small business set-aside under SBA regulations, classified as a Total Small Business Set-Aside, and falls under NAICS code 541611 for management, scientific, and technical consulting services. It is issued by the Department of Defense through the W071 Endist Seattle office, with performance expected to occur in Seattle. Prospective offerors must submit responses by May 12, 2026, and the opportunity is accessible through the SAM.gov portal. While no specific point of contact is listed, the contract demands detailed coordination across technical, compliance, and subcontract management functions to meet the stringent requirements of government cybersecurity procurement standards.