Cybersecurity Compliance (CMMC Level 2 Self-Assessment)

The contract requires the performance and documentation of a CMMC Level 2 self-assessment for a prime contractor, focusing on evaluating compliance with NIST SP 800-171 controls, identifying gaps in current cybersecurity practices, and producing comprehensive documentation to support assessment readiness. The work includes a detailed gap analysis to pinpoint areas where the contractor's security posture does not meet required standards, followed by the development and organization of evidence and policies to demonstrate alignment with the framework. Submission support is also included to ensure all required materials are correctly compiled and delivered according to CMMC guidelines. This is a subcontract under a Total Small Business Set-Aside, classified under NAICS code 541512 for computer systems design services, and is managed by the Department of Defense’s Nuclear Reactor Program. The place of performance is specified as New Cumberland, Pennsylvania, with a ZIP code of 17070-5002. The solicitation was posted on July 23, 2026, and responses are due by August 3, 2026. All work must be executed by a small business entity as defined by the SBA, and the contractor must ensure full adherence to federal cybersecurity compliance standards throughout the assessment lifecycle.