Cybersecurity Compliance (CMMC/NIST SP 800-171)

The contract requires the implementation of NIST SP 800-171 cybersecurity controls to protect covered defense information and full support for a CMMC Level 2 assessment, ensuring compliance with Department of Defense cybersecurity standards. The winning party must demonstrate the ability to systematically apply a comprehensive set of security practices and procedures aligned with NIST guidelines and successfully prepare for and pass a third-party CMMC certification audit at Level 2, which encompasses 110 security requirements across 17 domains. This subcontract is intended for a technical services provider capable of integrating these controls into existing IT infrastructure and operational workflows without disrupting mission-critical functions. The solicitation, issued by the Strategic Acquisition Program Directorate under the Department of Defense, is classified as a subcontract with a NAICS code of 541512 for computer systems design services. The opportunity was posted on July 14, 2026, with responses due by July 29, 2026, indicating a narrow window for qualified entities to submit proposals. While the precise location of performance remains unspecified, the work must be performed in alignment with federal cybersecurity mandates and likely involves collaboration with defense contractors or entities handling sensitive government information. All compliance activities must be documented and verifiable to meet CMMC Level 2 requirements, including policy development, personnel training, access controls, audit logging, and incident response readiness.