Cybersecurity Compliance for CUI Handling (NIST SP 800-171 & CMMC Level 2)

This contract requires the implementation, assessment, and documentation of cybersecurity controls to ensure systems handling Controlled Unclassified Information (CUI) meet the requirements of NIST SP 800-171 and CMMC Level 2 standards. The work involves establishing and validating technical and procedural safeguards across all relevant systems to protect CUI from unauthorized access, disclosure, or compromise. Compliance must be demonstrated through detailed documentation, evidence of control implementation, and an independent assessment to verify adherence to the specified frameworks. The contract is structured as a subcontract under the Department of Defense’s ASC Commodities Division, with performance centered at New Cumberland, Pennsylvania, 17070-5002. It falls under NAICS code 541512, indicating services related to computer systems design and related activities. The solicitation was posted on July 31, 2026, with responses due by August 5, 2026. While no set-aside type is specified, bidders must demonstrate capability in executing cybersecurity compliance projects for federal CUI environments, with a strong emphasis on measurable outcomes, audit readiness, and alignment with DoD cybersecurity expectations.