Cybersecurity Compliance (CMMC Level 2 Implementation)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls across all IT systems that handle Controlled Unclassified Information, ensuring alignment with the Department of Defense’s DFARS requirements. The vendor must achieve and sustain CMMC Level 2 certification through self-attestation, demonstrating compliance with all applicable cybersecurity practices and processes outlined in the NIST framework. This includes establishing robust policies, conducting regular assessments, securing access to systems, and maintaining audit-ready documentation to validate adherence to the standards. The obligation extends to continuous monitoring and improvement of cybersecurity posture, with a focus on protecting CUI throughout its lifecycle. The effort is time-bound, with a response deadline of August 31, 2026, and is structured as a subcontract under the Department of Defense, specifically tied to the Defense Logistics Agency Aviation at Oklahoma City. The North American Industry Classification System code 541512 indicates this is an information technology services contract, emphasizing the need for technical expertise in cybersecurity compliance, risk management, and federal regulatory adherence. All work must be performed to meet the strict criteria of CMMC Level 2 without reliance on third-party assessment, placing full responsibility for certification on the contractor.