Cybersecurity Compliance (CMMC) Implementation and SPRS Management

The contract requires full implementation of the Cybersecurity Maturity Model Certification (CMMC) framework to ensure compliance with federal cybersecurity standards for systems handling Controlled Unclassified Information and Federal Contract Information. The contractor must maintain an up-to-date Supplier Performance Risk System (SPRS) profile to accurately reflect CMMC certification status and ongoing compliance. All subcontracts involving FCI or CUI must include the mandatory clause 252.204-7021 to enforce consistent cybersecurity requirements across the supply chain, ensuring end-to-end alignment with DoD expectations. Continuous monitoring, documentation, and verification are essential to sustain compliance throughout the contract period. This is an 8(a) sole source subcontract awarded by the Portsmouth Naval Shipyard under the Department of Defense, with performance based in Kittery, Maine, 03904. The North American Industry Classification System code 541512 indicates the scope involves computer systems design and related services. The solicitation was posted on July 21, 2026, with responses due by July 23, 2026, suggesting a tight turnaround for an urgent compliance-driven procurement. The contractor is expected to deliver immediate and sustained cybersecurity readiness without the competitive bidding process, reflecting the specialized nature of the mission and the criticality of secure handling of sensitive information.