Cybersecurity Compliance – NIST SP 800-171 and CMMC Level 2

The contract requires the implementation and documentation of all NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) within contractor systems, ensuring alignment with federal cybersecurity standards. The work includes conducting a comprehensive self-assessment to achieve CMMC Level 2 certification, which involves verifying the proper application of access controls, identification and authentication, audit and accountability, system and communications protection, and other required safeguards. Documentation must be thorough and verifiable to support the self-assessment and demonstrate compliance across all 110 controls outlined in the NIST framework. This subcontract is a total small business set-aside under SBA guidelines, restricted to qualifying small businesses, and falls under NAICS code 541511 for computer systems design services. The performance location is Hill AFB, Utah, with a zip code of 84056-5734. The solicitation was posted on July 30, 2026, and responses are due by August 7, 2026. The contracting activity is under the Department of Defense’s ASC Commodities Division, and the work must be executed in accordance with all applicable federal acquisition regulations. Subcontractors must be prepared to provide full transparency of their cybersecurity posture, including policies, procedures, and evidence of control implementation, to meet CMMC Level 2 requirements without external audit.