Cybersecurity Compliance (CMMC Level 2)

The contract outlines the implementation and self-assessment requirements for achieving CMMC Level 2 compliance, encompassing the full suite of NIST SP 800-171 security controls necessary to protect controlled unclassified information within federal contractor systems. This includes establishing, documenting, and operationalizing policies and procedures that address access control, audit and accountability, configuration management, incident response, and risk assessment, among other control families mandated under the standard. The contractor is responsible for conducting a thorough internal self-assessment to validate compliance and maintaining documentation to substantiate implementation, with the expectation that all findings and corrective actions are tracked and resolved prior to submission. Additionally, the contract mandates strict adherence to cyber incident reporting requirements under FAR 52.204-7012, obligating rapid notification and full cooperation with the Department of Defense in the event of a breach, compromise, or unauthorized access to covered defense information. All activities must be performed in alignment with Defense Logistics Agency expectations as part of a subcontract under the broader Department of Defense cybersecurity framework, with performance tied to the NAICS code 541512 for computer systems design services. The work is to be executed without geographic restriction, and compliance must be sustained continuously throughout the contract lifecycle to maintain eligibility for future DOD engagements.