Cybersecurity Compliance (CMMC Level 2 Self-Assessment)

The contract requires the performance and ongoing maintenance of a CMMC Level 2 self-assessment for systems that process, store, or transmit controlled unclassified information, ensuring full alignment with the NIST SP 800-171 security requirements and the DFARS 252.204-7012 clause. This compliance effort is critical to safeguarding sensitive defense information and must be conducted in accordance with the Cybersecurity Maturity Model Certification framework, with documentation and evidence maintained to demonstrate adherence to all 110 security controls outlined in NIST SP 800-171. The work is to be carried out for systems located at Tinker Air Force Base, ZIP 73145-8000, under the oversight of the Department of Defense’s ASC SUPPLIER OPER AE AND AF DIV. The contract is structured as a subcontract, with a response deadline of July 28, 2026, and was posted on July 20, 2026, indicating a narrow window for submission. It falls under NAICS code 541512, which corresponds to computer systems design and related services, underscoring the technical nature of the compliance tasks involved. While no specific point of contact or set-aside designation is provided, the place of performance is clearly defined, and all activities must be executed to meet the stringent cybersecurity standards mandated for DoD subcontractors handling CUI. The contractual obligations extend beyond a one-time assessment to include sustained compliance, continuous monitoring, and readiness for validation or audit at any time.