NIST SP 800-171 Compliance and CMMC Level 2 Self-Assessment Support

The contract requires support to assist a prime contractor in achieving compliance with NIST SP 800-171 standards and completing a CMMC Level 2 self-assessment for the protection of Controlled Unclassified Information. This effort focuses on implementing and documenting the necessary security controls to meet federal cybersecurity requirements for handling sensitive government data. The work involves evaluating current systems, identifying gaps in security posture, developing remediation plans, and preparing documentation to demonstrate compliance with both NIST requirements and CMMC Level 2 criteria. This is a small business set-aside subcontract solicited under the SBA Total Small Business Set-Aside program with a NAICS code of 541512, indicating it targets information technology services. The contract posting date is July 22, 2026, with a response deadline of August 6, 2026. It is tied to the Department of Defense through the Maritime Supply Chain agency and is intended to be performed at an unspecified location. The goal is to ensure the prime contractor can successfully self-assess and validate its cybersecurity framework to qualify for handling CUI under the CMMC program.