Cybersecurity Compliance (NIST SP 800-171 / CMMC Level 2)

The contract requires the performer to conduct a comprehensive self-assessment and maintain detailed documentation to achieve compliance with NIST SP 800-171 Rev 1 and Cybersecurity Maturity Model Certification (CMMC) Level 2 standards for the handling of Controlled Unclassified Information. This involves implementing and verifying a suite of security controls designed to protect sensitive government data, ensuring all processes, systems, and personnel adhere to federal cybersecurity requirements. The obligation extends to ongoing recordkeeping and evidence gathering that demonstrates consistent adherence to these frameworks throughout the performance period. This subcontract is issued under the Department of Defense’s ASC SUPPLIER OPER OEM DIVISION and is specifically scoped for performance at New Cumberland, Pennsylvania, with a zip code of 17070-5002. Solicited on May 12, 2026, responses must be submitted by May 20, 2026, under the NAICS code 541618, which pertains to other scientific and technical consulting services. The effort is critical for maintaining eligibility to handle CUI within the defense supply chain, and non-compliance could result in contract termination or loss of future business opportunities. All activities must be aligned with the rigorous demands of CMMC Level 2 certification, including third-party validation readiness.