Cybersecurity Compliance (CMMC Level 2 Implementation)

The contract requires the implementation of all NIST SP 800-171 security controls to secure controlled unclassified information within information systems, with the ultimate goal of achieving CMMC Level 2 certification in alignment with DFARS requirements. The work involves a comprehensive assessment of current cybersecurity practices, identification of gaps against the NIST framework, and the execution of corrective actions including policy development, technical safeguards, personnel training, and continuous monitoring procedures. All activities must adhere to the standards set forth by the Department of Defense to ensure compliance with federal cybersecurity mandates for contractors handling sensitive defense information. Performance is to be completed at the specified location in New Cumberland, Pennsylvania, with a response deadline of August 12, 2026. This is a subcontract under the North American Industry Classification System code 541512, which covers computer systems design services. The contracting activity falls under the ASC Commodities Division of the Department of Defense, and the successful bidder must be prepared to demonstrate full alignment with CMMC Level 2 requirements through documentation, third-party assessments, and ongoing evidence of control implementation and maintenance. The contract emphasizes not only initial compliance but also sustained readiness for audit and verification by authorized DOD entities.