Cybersecurity Compliance (NIST SP 800-171 / CMMC)

The contract requires the implementation and documentation of cybersecurity controls aligned with NIST SP 800-171 to safeguard Controlled Unclassified Information (CUI) across systems supporting a potential CMMC Level 2 assessment. The work is scoped to ensure full compliance with the required security standards, including proper control implementation, policy development, system hardening, and audit-ready documentation to demonstrate adherence to federal cybersecurity requirements. The effort must be performed at the specified place of performance in New Cumberland, PA, with all deliverables tailored to meet the stringent criteria for CMMC Level 2 certification and potential inclusion in the Department of Defense supply chain. This is a subcontract under a Total Small Business Set-Aside, restricted to small businesses as defined by the Small Business Administration, with the North American Industry Classification System code 541512 indicating it pertains to computer systems design services. The solicitation was posted on July 23, 2026, and responses are due by August 3, 2026, under the MARITIME SUPPLY CHAIN office within the Department of Defense. Contractors must be prepared to operate within the regulatory framework of federal cybersecurity mandates and deliver verifiable proof of compliance through technical documentation and operational evidence, ensuring readiness for third-party assessment without delays that could impact supply chain eligibility.