CMMC & NIST SP 800-172 Compliance Consulting

This subcontract opportunity is for CMMC and NIST SP 800-172 Compliance Consulting to support prime contractors on Defense Advanced Research Projects Agency projects. The selected provider will deliver cybersecurity auditing and compliance services, specifically performing annual affirmations for 24 NIST SP 800-172 requirements and ensuring adherence to CMMC Level 2 self-assessment standards. Key deliverables include comprehensive compliance reports and security documentation, with a strict requirement for the provider to hold Certified CMMC Professional certification and disclose any Organizational Conflicts of Interest. The project is designated as a Total Small Business Set-Aside under NAICS code 541519, specifically targeting firms with fewer than 500 employees. Interested parties must submit their responses by October 21, 2026. This engagement focuses on maintaining rigorous security standards for Department of Defense initiatives through specialized technical oversight and certification validation.