CMMC Level 2 Third-Party Cybersecurity Assessment Services

The contract seeks qualified providers to perform comprehensive cybersecurity assessments of defense contractors to ensure compliance with CMMC Level 2, NIST SP 800-171, and DFARS requirements. These assessments will involve both on-site and remote evaluations, including detailed reviews of policies, procedures, technical controls, and documentation to verify adherence to federal cybersecurity standards. The work requires a thorough understanding of the Cybersecurity Maturity Model Certification framework and the ability to conduct objective, standardized audits that accurately reflect an organization’s cybersecurity posture. The contract is classified as a subcontract under the NAICS code 541612 and is issued by the Department of Defense through the LAND SUPPLY CHAIN organization. Responses are due by August 10, 2026, following a posting date of July 29, 2026. While no specific location is mandated for performance, the assessments may occur at contractor facilities across the U.S. or virtually, depending on the evaluator’s method and client constraints. Successful bidders must demonstrate proven experience in third-party cybersecurity auditing within the defense industrial base and be prepared to deliver detailed, actionable reports that support DOD’s mission to secure sensitive unclassified information in the supply chain.