Cybersecurity Compliance (NIST SP 800-171 & CMMC Level 2)

The contract requires the contractor to conduct a comprehensive self-assessment and implement robust security controls to achieve compliance with NIST Special Publication 800-171 and Cybersecurity Maturity Model Certification Level 2 standards, specifically for the protection of Controlled Unclassified Information as mandated under DFARS 252.204-7012. This involves evaluating existing cybersecurity practices, identifying gaps, and enforcing technical and administrative safeguards to ensure the confidentiality, integrity, and availability of CUI handled in support of Department of Defense operations. The effort must align with federal cybersecurity frameworks and be fully operational by the required compliance deadline. The work is performed under a subcontract associated with the ASC SUPPLIER OPER OEM DIVISION, with the primary place of performance located at Hill Air Force Base, Utah, 84056-5734. The solicitation was posted on April 22, 2026, with responses due by April 30, 2026, indicating a tight turnaround for compliance planning and implementation. The NAICS code 541611 indicates the work falls under Management Consulting Services, suggesting the scope may include both assessment and strategic implementation support. Compliance is non-negotiable and essential for continued participation in the defense supply chain, with failure to meet requirements potentially resulting in contract termination or loss of eligibility for future DoD work.