Cybersecurity Compliance (NIST SP 800-171 / CMMC Level 2)

The contract requires the implementation and self-assessment of NIST SP 800-171 controls and CMMC Level 2 requirements to ensure the protection of covered defense information throughout contract performance. This effort is focused on establishing a robust cybersecurity posture aligned with federal standards for handling sensitive information within the defense supply chain. The prime contractor must demonstrate full compliance with these frameworks through documented processes, technical safeguards, and operational practices that mitigate risks to unclassified controlled technical information and other covered defense data. This subcontract is issued as a Total Small Business Set-Aside under SBA regulations, meaning only small business concerns are eligible to respond. The North American Industry Classification System code 541512 indicates the work involves computer systems design and related services. Performance will take place in San Diego, California, with a strict submission deadline of August 17, 2026, and the solicitation was posted on August 4, 2026. The contract is managed by the Department of Defense through its San Diego office, and all compliance activities must be completed in alignment with the specified cybersecurity standards to ensure continued eligibility for defense contracting work involving controlled unclassified information.