Cybersecurity Assessment (CMMC Level 2 C3PAO)

A third-party cybersecurity assessment under the Cybersecurity Maturity Model Certification (CMMC) Level 2 is being solicited to evaluate the prime contractor’s compliance with federal cybersecurity standards for handling covered defense information. The assessment must be conducted by an accredited CMMC Third-Party Assessment Organization (C3PAO) and is a critical requirement to maintain eligibility for defense contracting activities involving sensitive unclassified information. The contract is structured as a subcontract, with performance expected to take place in Enid, Oklahoma, and is governed under NAICS code 541611 for management consulting services. The solicitation opened on July 15, 2026, with responses due by July 27, 2026, and is issued by the Department of Defense under the LAND SUPPLY CHAIN organization. While no set-aside provisions are specified, the assessment must strictly adhere to CMMC Level 2 requirements to validate implementation of required safeguards and practices outlined in the CMMC framework. The procurement is managed through the DIBBS system, and all submissions must align with the technical and procedural expectations established by the DoD for CMMC compliance validation.