Cybersecurity Assessment and CMMC Level 2 Compliance

The contract seeks a third-party provider to deliver Cybersecurity Maturity Model Certification (CMMC) Level 2 assessment and compliance support services to a prime contractor engaged with the Department of Defense. The scope includes conducting a comprehensive gap analysis to identify deficiencies in the contractor’s current cybersecurity posture regarding the handling of Controlled Unclassified Information (CUI), developing and refining necessary documentation to meet CMMC Level 2 requirements, and ensuring full audit readiness through structured remediation and validation processes. The provider must possess proven expertise in CMMC frameworks and be capable of delivering end-to-end support that aligns with federal cybersecurity standards for safeguarding sensitive information. This is a subcontract under a Total Small Business Set-Aside, solicited by the Defense Logistics Agency under the NAICS code 541611 for management consulting services, with performance based in New Cumberland, Pennsylvania. The opportunity is open to small businesses only and requires responses by August 12, 2026. The contracting office, under the ASC Supplier Oper AE and AF Division, is seeking a vendor well-versed in defense sector compliance to help ensure the prime contractor meets mandatory CMMC Level 2 thresholds, with the ultimate goal of securing ongoing eligibility to handle CUI in DOD supply chain operations.