CMMC Level 2 Third-Party Assessment Services

The contract awarded under the Defense Logistics Agency within the Department of Defense seeks independent third-party cybersecurity assessment services to validate compliance with the Cybersecurity Maturity Model Certification Level 2 standards for organizations handling Controlled Unclassified Information. The scope requires qualified assessors to conduct thorough evaluations of an organization’s cybersecurity practices, policies, and technical controls to ensure alignment with CMMC Level 2 requirements, which include implementing 110 specific security controls designed to protect CUI. The service is structured as a subcontract and is associated with the NAICS code 541611, indicating it falls under management consulting services, specifically focused on cybersecurity evaluation and certification. The contract was posted on June 3, 2026, and its performance location is not specified, suggesting it may be conducted across multiple sites where CUI is processed or stored. The assessment outcome will serve as official certification confirming the contractor’s readiness to handle sensitive unclassified information in accordance with DoD standards.