Cybersecurity Compliance (NIST SP 800-171 / CMMC Level 2)

The contract requires the implementation of NIST SP 800-171 security controls to safeguard controlled unclassified information within the contractor’s systems, ensuring compliance with federal cybersecurity standards for handling sensitive data. This effort is specifically aimed at preparing the organization for a CMMC Level 2 self-assessment, which demands a documented and operational cybersecurity posture aligned with the 110 controls outlined in NIST SP 800-171 and additional CMMC framework requirements. The work must be completed in accordance with Department of Defense expectations and is tied to a subcontract under the NAICS code 541512, indicating IT services and related cybersecurity support. Performance is required at the location in Texarkana, Texas, with a response deadline of August 3, 2026, and the solicitation was posted on July 22, 2026. The contractor must establish, document, and maintain robust security practices covering access control, audit and accountability, configuration management, incident response, and system and communications protection among other areas. Success will be measured by readiness for CMMC Level 2 certification, which requires not only technical controls but also organizational policies, procedures, and evidence of consistent security practices over time, all focused on protecting CUI from unauthorized access, disclosure, or compromise.