CMMC Level 2 Third-Party Certification Audit

The contract requires the performance of an official CMMC Level 2 certification audit as a C3PAO, with the full validation of all 110 NIST SP 800-171 security controls applicable to covered defense contractors handling controlled unclassified information. The audit must be conducted in accordance with CMMC program requirements, ensuring rigorous assessment of policies, technical safeguards, and organizational practices to confirm compliance with federal cybersecurity standards. All findings and evidence must be thoroughly documented and results formally submitted to the System for Award Management’s Supplier Performance Risk System for official record and compliance tracking. The work is to be performed at a designated location in Tracy, California, with a zip code of 95304-5000, and falls under NAICS code 541690 for other scientific and technical consulting services. The contract is classified as a subcontract under the Department of Defense’s ASC Commodities Division and is open for responses until May 20, 2026, with the solicitation posted on May 12, 2026. Participation is contingent upon the bidder’s active C3PAO authorization and demonstrated capability to execute CMMC Level 2 audits in compliance with DoD mandates, with no set-aside provisions specified for small or disadvantaged businesses.