CMMC Level 2 Compliance and Cybersecurity Assessment

The contract requires a formal CMMC Level 2 cybersecurity assessment to be conducted by a certified C3PAO to validate the prime contractor’s adherence to Department of Defense cybersecurity requirements. This assessment is a mandatory compliance activity tied to the contractor’s eligibility to perform under DoD contracts, ensuring the implementation of specified security controls outlined in the CMMC framework. The work must be completed by a qualified third-party assessor with official CMMC accreditation, and the results will serve as official documentation of the contractor’s cybersecurity posture and readiness to handle sensitive defense information. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside program, identified by NAICS code 541611, which corresponds to management consulting services. The solicitation was posted on July 13, 2026, with responses due by July 20, 2026, and is managed by the ASC SUPPLIER OPER AE AND AF DIV within the Department of Defense. Although no specific location for performance or point of contact is listed, the assessment activity is expected to be performed on-site or remotely at the prime contractor’s facilities to validate systems, policies, and procedures against CMMC Level 2 criteria. All deliverables must meet DoD standards and be submitted as part of the prime contractor’s compliance verification process.