Cybersecurity Compliance (CMMC Level 2 & NIST SP 800-171)

The contract focuses on implementing and assessing cybersecurity controls to achieve compliance with CMMC Level 2 and NIST SP 800-171 standards for the handling of controlled unclassified information. The work is required to ensure that all systems, processes, and personnel meet the mandated security requirements to protect sensitive data under the Department of Defense’s framework. This includes conducting a gap analysis, deploying technical and administrative controls, documenting policies and procedures, and preparing for third-party assessment to validate compliance. The effort must be completed by the response deadline of July 31, 2026, and is structured as a subcontract under the NAICS code 541512 for computer systems design services. The performance will be conducted in support of the Maritime Supply Chain within the Department of Defense, with no specific location designated for performance. All activities must align with federal cybersecurity standards and be tailored to the specific handling of CUI across the supply chain ecosystem. Success requires not only the technical implementation of controls but also ongoing documentation, training, and readiness for audit. The subcontractor must demonstrate expertise in CMMC and NIST frameworks, with a clear pathway to achieving and maintaining compliance through continuous monitoring and improvement of security practices.