CMMC Level 2 Certification and Cybersecurity Compliance

The contract requires a third-party provider to deliver CMMC Level 2 assessment and certification services to ensure full compliance with DFARS 252.204-7012 for the protection of Covered Defense Information. This effort is critical for securing sensitive data within the defense supply chain and involves evaluating an organization’s cybersecurity practices against the NIST SP 800-171 requirements as mandated by the CMMC framework. The work must be performed at the designated place of performance in New Cumberland, Pennsylvania, with the resulting certification validating that the contractor meets the necessary baseline security controls for handling CUI. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside program, with the NAICS code 541611 indicating it falls within consulting services for management, scientific, and technical needs. The solicitation was posted on July 16, 2026, with responses due by July 24, 2026, and is managed by the Department of Defense through the ASC SUPPLIER OPER AE AND AF DIV. While no point of contact is listed, the opportunity is accessible via the DIBBS platform, and all bidders must be certified small businesses eligible under the set-aside guidelines to qualify for award.