Cybersecurity Compliance (CMMC/NIST SP 800-171)

The contractor is required to develop and maintain a comprehensive System Security Plan (SSP) for systems handling Controlled Unclassified Information (CUI), ensuring full alignment with NIST SP 800-171 security requirements. This includes implementing all applicable controls, documenting security processes, and establishing procedures for ongoing monitoring and updates to address evolving threats and regulatory changes. The contractor must also conduct a formal CMMC Level 2 self-assessment to evaluate readiness and compliance posture, documenting findings and remediation plans to meet the standard’s maturity level requirements for safeguarding CUI. The work is performed under a subcontract for the Department of Defense’s ASC Commodities Division, with performance centered in Tracy, California, zip code 95304-5000. The solicitation is categorized under NAICS code 541512, indicating the nature of the work involves computer systems design and related services. Responses must be submitted by May 21, 2026, and the opportunity is not subject to any specific set-aside designation. The contractor is expected to deliver documented evidence of compliance, maintain audit readiness, and support any future verification efforts related to CMMC Level 2 certification without reliance on third-party assessments during the self-assessment phase.