Cybersecurity Compliance (NIST SP 800-171 / CMMC Level 2)

The contract requires the implementation and assessment of cybersecurity controls to ensure compliance with NIST SP 800-171 and CMMC Level 2 standards for safeguarding controlled unclassified information within defense-related operations. The work involves establishing, validating, and maintaining a robust cybersecurity framework that meets federal requirements for protecting sensitive data handled under defense contracts, with emphasis on technical, administrative, and physical safeguards aligned with these frameworks. The recipient must demonstrate full operational readiness to pass a third-party assessment for CMMC Level 2 certification by the contract's performance timeline. Performance is to be carried out at Robins Air Force Base, Georgia, with a specific deadline for response set for August 17, 2026, following a posting date of August 9, 2026. This is a subcontract opportunity under NAICS code 541512 for computer systems design services, managed by the Department of Defense through the ASC SUPPLIER OPER AE AND AF DIV. The focus is on achieving compliance readiness rather than just documentation, requiring active implementation of controls and documentation of their effectiveness across the organization’s information systems. There is no set-aside classification specified, indicating open competition among qualified vendors.