Cybersecurity Compliance (NIST SP 800-171 / CMMC Level 2)

The contract requires full implementation and self-assessment of NIST SP 800-171 security controls to safeguard Covered Defense Information, ensuring alignment with the cybersecurity standards mandated for contractors handling sensitive DoD data. This includes establishing technical, administrative, and physical safeguards across systems and processes to meet the baseline requirements for protecting controlled unclassified information, with a clear emphasis on ongoing compliance and internal evaluation. The contractor must document all implemented controls and conduct a thorough self-assessment to verify adherence, submitting the results as part of the contractual obligation. Additionally, the contract mandates immediate reporting of any cybersecurity incidents involving Covered Defense Information in accordance with DFARS 252.204-7012, requiring prompt notification to the Department of Defense and cooperation in incident response and mitigation efforts. This subcontract falls under NAICS code 541512 and is issued by the ASC SUPPLIER OPER OEM DIVISION of the Department of Defense, with a response deadline of August 5, 2026. The requirement is part of the broader transition toward CMMC Level 2 compliance, reinforcing the expectation that the contractor operates under a robust cybersecurity posture consistent with federal defense standards.