Cybersecurity Compliance (CMMC Level 2)

The contract requires the implementation and thorough documentation of all NIST SP 800-171 controls to attain CMMC Level 2 certification, specifically for systems handling Controlled Unclassified Information within the defense supply chain. This effort is critical to meeting federal cybersecurity standards mandated for contractors supporting Department of Defense operations, ensuring that sensitive data is protected against unauthorized access, disclosure, or compromise. The work must be completed in accordance with CMMC framework requirements, including policy development, technical safeguards, access controls, audit and accountability measures, and continuous monitoring practices aligned with NIST guidelines. Performance of this subcontract is designated for Robins AFB, Georgia, with a response deadline of July 24, 2026, and a North American Industry Classification System code of 541512, indicating it pertains to computer systems design services. The solicitation is managed by the Active Devices Division under the Department of Defense, emphasizing its relevance to defense-related IT infrastructure and cybersecurity readiness. Although no set-aside type is specified, the nature of the work and the CMMC Level 2 requirement suggest it targets qualified cybersecurity service providers with demonstrated expertise in handling CUI and achieving federal compliance. All deliverables must be comprehensive, auditable, and capable of withstanding third-party assessment to validate certification status.