CMMC Level 2 Third-Party Assessment (C3PAO) Services

The contract requires a CMMC Level 2 third-party assessment to be conducted for a prime contractor to verify adherence to DFARS cybersecurity requirements and NIST SP 800-171 controls. The assessment must be performed by an accredited C3PAO to ensure the prime contractor meets the mandatory security standards for handling controlled unclassified information within the Department of Defense supply chain. The work is scoped specifically to evaluate compliance through a formal assessment process, not consulting or implementation services, and must result in an official certification report attesting to the prime’s cybersecurity posture. The opportunity is issued as a subcontract under the NAICS code 541611 for management consulting services and is tied to the ASC Commodities Division of the Department of Defense. The performance location is specified as New Cumberland, PA with a ZIP code of 17070-5002. The solicitation was posted on July 14, 2026, and all responses are due by July 22, 2026. The contract is accessible via the DIBBS platform, and while no set-aside provisions are identified, potential offerors must be authorized C3PAOs capable of executing CMMC Level 2 assessments under DoD guidelines.