Cybersecurity Compliance (NIST SP 800-171 & CMMC Level 2)

The contract requires the implementation and thorough documentation of NIST SP 800-171 controls to safeguard Controlled Unclassified Information (CUI) within the specified environment, ensuring alignment with Department of Defense cybersecurity standards. This includes configuring systems, policies, and procedural safeguards to meet each of the 110 security requirements outlined in NIST SP 800-171, with a focus on access control, audit and accountability, configuration management, identification and authentication, and incident response. The contractor must maintain detailed records of all control implementations, including evidence of configuration, training, and monitoring activities, to support verification and future assessments. In addition to implementing the NIST controls, the contractor must perform a self-assessment against the Cybersecurity Maturity Model Certification (CMMC) Level 2 framework as mandated by DFARS requirements. This involves evaluating the effectiveness of the implemented controls, identifying any gaps, and documenting remediation plans where necessary. The self-assessment must be conducted using the official CMMC assessment methodology, resulting in a formal report that demonstrates compliance with the 130 practices required at CMMC Level 2. All work must be performed at the designated place of performance in New Cumberland, Pennsylvania, and deliverables must be submitted prior to the response deadline of August 10, 2026, under a subcontract arrangement tied to a DoD procurement with NAICS code 541512 for computer systems design services.