Cybersecurity Compliance (NIST SP 800-171 / CMMC Level 2) and Incident Reporting

The contract requires the implementation and ongoing maintenance of cybersecurity controls aligned with NIST SP 800-171 to safeguard Controlled Unclassified Information across all systems and processes. This includes establishing, validating, and continuously monitoring compliance with the full set of 110 security requirements outlined in the standard, ensuring that CUI is handled, stored, transmitted, and disposed of in accordance with federal guidelines. The effort must also support attainment and sustained certification at Cybersecurity Maturity Model Certification Level 2, which demands documented policies, procedures, and operational practices that demonstrate a proactive and organized cyber defense posture. All activities must be fully traceable and auditable to meet Department of Defense expectations for supply chain security. Additionally, the contractor is responsible for establishing a robust cyber incident reporting system compliant with DFARS 252.204-7012, requiring immediate notification of any security breaches or anomalies affecting CUI, along with accurate and timely submission of incident reports to the DoD. The work is to be performed at the designated location in Corpus Christi, Texas with a deadline for responses set for July 29, 2026. This subcontract falls under NAICS code 541512 for computer systems design services and is issued by the Department of Defense through the ASC SUPPLIER OPER OEM DIVISION, indicating direct relevance to defense supply chain operations and the need for stringent adherence to federal cybersecurity mandates.