Cybersecurity Compliance (CMMC Level 2 / NIST SP 800-171)

The contract requires implementation of NIST SP 800-171 cybersecurity controls and support for CMMC Level 2 certification through a Third-Party Assessment Organization to ensure proper handling of controlled defense information. The work is focused on achieving full compliance with these standards to meet Department of Defense requirements for safeguarding sensitive data. The performance of this work is designated to occur at Robins Air Force Base, Georgia, with a zip code of 31098-1887, indicating the physical location where the cybersecurity infrastructure and processes must be established and validated. This is a subcontract under the NAICS code 541512, categorized as an information technology services contract, with a proposed posting date of July 30, 2026, and a mandatory response deadline of August 10, 2026. The contracting activity is managed by the Active Devices Division under the Department of Defense, and the entity submitting the proposal must be prepared to undergo a formal assessment by an accredited CMMC Third-Party Assessor. Compliance must encompass all 110 security controls specified in NIST SP 800-171, documentation of policies and procedures, employee training, system hardening, and continuous monitoring to maintain certification readiness. The successful offeror will need demonstrated experience with federal cybersecurity frameworks and the ability to operate within a highly regulated defense environment.