Cybersecurity Compliance (CMMC Level 2 & NIST SP 800-171)

The contract requires implementation and documentation of all NIST SP 800-171 cybersecurity controls to ensure compliance with federal standards for protecting controlled unclassified information. This includes establishing policies, procedures, and technical safeguards aligned with the framework, as well as maintaining comprehensive documentation to demonstrate adherence across all applicable systems and processes. A CMMC Level 2 self-assessment must be conducted and submitted through the Supplier Performance Risk System, verifying compliance with the assessed maturity level requirements and ensuring proper validation of security posture prior to award. The contractor is also responsible for managing all aspects of cyber incident reporting, including timely detection, response, and reporting of any security events in accordance with contractual and regulatory obligations. The work is to be performed in Phoenix, Arizona, with a response deadline of August 3, 2026, and falls under NAICS code 541512 for computer systems design services. This is a subcontract opportunity under the Department of Defense’s ASC Commodities Division with no set-aside designation. While the contracting office address is not fully specified, performance is clearly tied to the Phoenix location, and all activities must be completed within the defined timeline to meet compliance obligations and maintain eligibility for future defense-related engagements.