CMMC Level 2 Certification and Cybersecurity Compliance Services

The contract requires comprehensive cybersecurity services to achieve CMMC Level 2 certification by conducting a detailed gap analysis against NIST SP 800-171 standards for the protection of Controlled Unclassified Information, followed by targeted remediation support to address identified deficiencies. The vendor must work closely with the contracting entity to implement necessary controls, document compliance efforts, and coordinate formal assessment and certification through an accredited C3PAO to validate full adherence to the required cybersecurity framework. All activities must align with the specific requirements of the Department of Defense and be performed within the designated place of performance in New Cumberland, Pennsylvania, with a ZIP code of 17070-5002. This is a subcontract under a Total Small Business Set-Aside, meaning only small businesses as defined by the SBA are eligible to respond, and the NAICS code 541611 classifies the work as Management, Scientific, and Technical Consulting Services. The solicitation was posted on August 3, 2026, with responses due by August 14, 2026, and is managed by the Maritime Supply Chain under the Department of Defense. The contract is accessible through the DIBBS portal, and all deliverables must meet federal standards for cybersecurity compliance, ensuring the entity can legally handle CUI on behalf of the DoD.