Cybersecurity Compliance (NIST SP 800-171 / CMMC)

The contract requires the implementation and documentation of NIST SP 800-171 security controls to protect controlled unclassified information (CUI) in alignment with DFARS 252.204-7012 requirements. This includes establishing technical, administrative, and physical safeguards to ensure the confidentiality, integrity, and availability of CUI, as well as developing and maintaining formal policies, procedures, and evidence of compliance. The contractor must also be prepared to support cyber incident reporting obligations, ensuring timely detection, response, and notification of any security breaches involving CUI in accordance with federal guidelines. The work is being performed under a subcontract tied to the Department of Defense, specifically under the ASC SUPPLIER OPER OEM DIVISION, with the place of performance located in New Cumberland, Pennsylvania, 17070-5002. The North American Industry Classification System code is 541512, indicating it relates to computer systems design services. The solicitation was posted on August 4, 2026, with a response deadline of August 12, 2026, and the contract is not designated for any specific set-aside classification. All deliverables must demonstrate full compliance with NIST SP 800-171 and support certification readiness under the Cybersecurity Maturity Model Certification framework.