CMMC Level 2 Third-Party Assessment (C3PAO) for Supply Chain Compliance

The contract seeks qualified third-party assessors to perform independent CMMC Level 2 certification evaluations for defense supply chain partners, ensuring adherence to DFARS cybersecurity standards for the handling of Controlled Unclassified Information. The assessments must validate that contractors have implemented the required security controls outlined in NIST SP 800-171 and are capable of maintaining ongoing compliance throughout their involvement in the defense ecosystem. This is a subcontract under the Department of Defense’s Land Supply Chain initiative, with the North American Industry Classification System code 541611 indicating management, scientific, and technical consulting services. The solicitation was posted on July 15, 2026, with responses due by August 14, 2026. The work will be performed remotely or on-site at various defense contractor locations, as needed, with no specific geographic restrictions indicated. The solicitation number is SPE7L126R0107, accessible through the DIBBS portal, and the requirement is not subject to set-aside classifications. Assessment candidates must be accredited C3PAOs with proven experience in conducting CMMC Level 2 evaluations and must demonstrate technical competence, impartiality, and alignment with DoD protocols for evaluating cybersecurity posture across the supply chain.