CMMC Level 2 Compliance and Cybersecurity Support

The contract seeks a small business to provide comprehensive advisory and assessment services to achieve CMMC Level 2 compliance for defense-related systems and operations. Services include developing a System Security Plan, conducting vulnerability assessments, and coordinating with certified third-party assessment organizations to validate compliance. The work requires thorough understanding of NIST SP 800-171 controls and the CMMC framework, with a focus on implementing and documenting cybersecurity practices across all applicable domains. The contractor must demonstrate experience in government cybersecurity compliance, particularly in defense supply chain contexts, and be prepared to engage directly with federal stakeholders to address gaps and ensure audit readiness. This subcontract is issued under a Total Small Business Set-Aside, meaning only small businesses certified by the Small Business Administration may respond. It falls under NAICS code 541512 for Computer Systems Design Services and is managed by the Department of Defense’s ASC SUPPLIER OPER AE AND AF DIV. Responses are due by August 12, 2026, with the solicitation posted on July 13, 2026. The place of performance is not specified, but work is expected to support DoD contractors and suppliers across various locations. The successful vendor will be responsible for delivering actionable, auditable documentation and ensuring alignment with all CMMC Level 2 requirements through direct collaboration with authorized assessors.