Cybersecurity Compliance (CMMC Level 2)

The contract requires the implementation and C3PAO assessment of CMMC Level 2 controls to ensure compliance with DFARS 252.204-7012 and NIST SP 800-171 for handling controlled unclassified information. The work is scoped as a subcontract under the NAICS code 541512, focusing on cybersecurity services for the Department of Defense, specifically tied to the Jacksonville facility with a place of performance at 32212-0103. The implementation must align with the full suite of CMMC Level 2 requirements, including administrative, technical, and procedural safeguards, and result in a formal assessment conducted by a certified third-party assessment organization. The solicitation was posted on July 23, 2026, with a response deadline of July 28, 2026, indicating a tight turnaround for proposers to submit viable plans and capabilities. The contract is structured as a subcontract, meaning the successful bidder will operate under the prime contractor’s direction and contractual obligations. Compliance is non-negotiable, as adherence to NIST SP 800-171 standards and CMMC Level 2 controls is mandatory for maintaining the confidentiality and integrity of sensitive DoD information. The requirement underscores the need for experienced cybersecurity professionals capable of executing a gap analysis, deploying corrective measures, and preparing for and passing an official C3PAO assessment within the specified timeframe.