Cybersecurity Compliance (CMMC Level 2)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to ensure the protection of federal contract information, with the ultimate goal of achieving CMMC Level 2 certification. This involves establishing comprehensive cybersecurity practices across all systems and processes that handle sensitive data, including access controls, audit and accountability measures, configuration management, and incident response protocols tailored to meet the CMMC framework’s requirements. The subcontractor must demonstrate continuous compliance through documentation, system assessments, and third-party evaluations to validate adherence to the specified standards. This effort is conducted under the oversight of the Defense Logistics Agency within the Department of Defense and is classified as a subcontract under NAICS code 541512, which pertains to computer systems design services. The work must be performed in alignment with federal cybersecurity mandates, and while the place of performance is unspecified, the compliance obligations apply regardless of location. Success requires sustained operational discipline, regular review of security controls, and readiness for audits to maintain certification status throughout the contract lifecycle.