Cybersecurity Compliance (CMMC Level 2 / NIST SP 800-171)

The contract requires implementation and self-assessment of cybersecurity controls to safeguard covered defense information in alignment with NIST SP 800-171 and CMMC Level 2 requirements. This includes establishing, documenting, and maintaining a robust security posture that meets the specified standards for protecting controlled unclassified information, with a focus on technical and administrative safeguards. The contractor must conduct a thorough internal assessment to demonstrate compliance and be prepared to validate readiness for potential third-party audits under the Cybersecurity Maturity Model Certification program. Additionally, the contract mandates strict adherence to cyber incident reporting obligations under DFARS 252.204-7012, requiring immediate notification and coordination with the Department of Defense in the event of any suspected or confirmed cyber incidents involving covered defense information. The work is performed under a subcontract with the Department of Defense, specifically for the ASC SUPPLIER OPER AE AND AF DIV, and places of performance are designated to FPO with ZIP code 09591. The solicitation is open for bids until August 10, 2026, and the NAICS code 541611 indicates the work falls under computer systems design and related services, requiring qualified vendors to demonstrate both technical and compliance expertise.