Cybersecurity Compliance (CMMC Level 2 & NIST SP 800-171)

The contract requires the implementation and assessment of cybersecurity controls to achieve compliance with CMMC Level 2 and NIST SP 800-171 standards for the handling of Controlled Unclassified Information. The scope centers on establishing, documenting, and validating technical and administrative safeguards aligned with these frameworks to protect CUI within systems and processes. The work must be performed at the designated place of performance in New Cumberland, Pennsylvania, with the contractor responsible for demonstrating full adherence through documented evidence and third-party assessments as required by CMMC certification criteria. This subcontract under the Department of Defense’s Nuclear Reactor Program is issued under NAICS code 541512 for computer systems design services, with a response deadline of July 16, 2026. The contractor must demonstrate prior experience in executing similar cybersecurity compliance projects and possess the technical capacity to conduct gap analyses, remediate deficiencies, and prepare for official CMMC third-party assessment. Full compliance with NIST SP 800-171 requirements is mandatory prior to submitting for CMMC Level 2 certification, and ongoing monitoring and documentation of control effectiveness will be essential throughout the contract period.