CMMC Level 2 Cybersecurity Assessment & Compliance

The contract requires the execution of a CMMC Level 2 cybersecurity assessment and certification for a prime contractor, ensuring full alignment with NIST SP 800-171 and DFARS requirements through a certified third-party assessment organization audit. The scope centers on verifying the implementation of cybersecurity controls necessary to protect controlled unclassified information, with the assessment to be conducted by an accredited C3PAO to meet Department of Defense compliance standards. The work must be completed in Mechanicstown, Pennsylvania, at the specified zip code, and all deliverables must be validated to achieve official CMMC Level 2 certification status. This contract is structured as a subcontract under the Department of Defense’s ASC Commodities Division, with a NAICS code of 541611 indicating it falls under Management, Scientific, and Technical Consulting Services. The solicitation was posted on July 30, 2026, and responses are due by August 7, 2026, providing a narrow window for qualified providers to submit proposals. While no set-aside designation is specified, bidders must be prepared to meet rigorous DOD cyber compliance benchmarks and demonstrate proven experience in conducting CMMC Level 2 assessments. The performance location and regulatory framework indicate this is a high-stakes compliance effort critical to maintaining the prime contractor’s eligibility for DoD contracts involving controlled unclassified information.