CMMC Compliance Implementation & Certification Support

The contract seeks consulting and implementation services to support the prime contractor and its supply chain in achieving and maintaining CMMC Level 2 (Self) certification. Services include conducting comprehensive gap assessments to identify non-compliance areas, developing required documentation aligned with NIST SP 800-171 requirements, creating detailed Plans of Action and Milestones to address deficiencies, and providing assistance with SPRS submission to ensure accurate and timely reporting. The scope is focused entirely on enabling compliance readiness through expert guidance and hands-on implementation support, ensuring the workforce and systems meet the federal cybersecurity standards mandated for defense contractors. The solicitation is structured as a small business set-aside under the SBA's Total Small Business Set-Aside authority, with the North American Industry Classification System code 541611 indicating management consulting services. The performance location is in Newport, Rhode Island, with a response deadline of May 6, 2026, at 4:00 PM. This subcontract is awarded through the Department of Defense's Nuwc Division Newport, and all work must be executed to satisfy the stringent cybersecurity requirements of the CMMC framework, with an emphasis on self-assessment and documented compliance without third-party validation. Contractors must demonstrate proven experience in CMMC readiness initiatives and a clear understanding of DoD procurement cybersecurity expectations.