CMMC Level 2 Cybersecurity Self-Assessment Support

The contract requires support to the prime contractor in executing a CMMC Level 2 cybersecurity self-assessment, focusing on identifying gaps in current security practices, documenting implementation of required NIST SP 800-171 controls, and preparing comprehensive materials for an upcoming third-party assessment. The work involves thorough analysis of existing cybersecurity frameworks, alignment with CMMC requirements, and development of policy and procedural documentation to demonstrate compliance across all relevant control families. Performance is centered in Tracy, California, with a zip code of 95304-5000, and the solicitation falls under NAICS code 541512 for computer systems design services. The opportunity is structured as a subcontract under the Department of Defense, specifically managed by the ASC Commodities Division, and is open for responses until July 22, 2026. The goal is to ensure the prime contractor can successfully meet CMMC Level 2 certification standards through accurate self-assessment and robust documentation, positioning them for external validation and continued eligibility to handle controlled unclassified information.