Cybersecurity Compliance (NIST SP 800-171 / CMMC)

The contract requires the implementation of NIST SP 800-171 security controls and completion of a CMMC Level 2 self-assessment to ensure the protection of controlled unclassified information in accordance with DFARS 252.204-7012. This effort is focused on establishing a robust cybersecurity posture to safeguard sensitive data handled by the subcontractor, aligning with Department of Defense requirements for information system security. The work must be executed to meet the full scope of NIST controls addressing access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, system and communications protection, and system and information integrity. The contract is classified as a subcontract under NAICS code 541512, with performance to take place in San Diego, California, at the zip code 92136-3581. It was posted on July 30, 2026, and responses are due by August 7, 2026. The contracting activity is under the ASC Commodities Division of the Department of Defense, indicating the work supports defense supply chain operations requiring strict compliance with federal cybersecurity standards. The subcontractor is expected to document and validate their compliance through a formal self-assessment process, ensuring readiness for potential government verification and maintaining the integrity of protected CUI throughout the contract lifecycle.