CMMC Level 2 Third-Party Assessment and Certification

The contract seeks a third-party provider to perform cybersecurity assessments and issue certification at CMMC Level 2 to ensure compliance with NIST SP 800-171 and DFARS 252.204-7012 for the handling of Covered Defense Information. This assessment is critical for validating that contractors have implemented the necessary security controls to protect sensitive federal data, and the certification will serve as official confirmation of adherence to Department of Defense cybersecurity requirements. The work is scoped as a subcontract under the ASC Commodities Division, with performance required at Tinker Air Force Base, Oklahoma, 73145-8000. The North American Industry Classification System code 541611 identifies this as an information technology consulting services engagement, specifically aimed at cybersecurity evaluation and assurance. The solicitation was posted on July 12, 2026, with a response deadline of July 20, 2026, indicating a tight turnaround for interested parties to submit proposals. The contract does not specify a set-aside designation and is classified as a subcontract, meaning the awardee will be supporting a prime contractor or another entity within the defense supply chain. The evaluation will center on technical capability to conduct rigorous, standardized CMMC Level 2 assessments, including documentation review, system testing, and final certification issuance under the CMMC program framework. The successful provider must demonstrate proven experience with NIST 800-171 compliance assessments and a clear understanding of the DFARS clause requirements governing the protection of sensitive defense information.