Cybersecurity Compliance and CMMC Assessment Support

The contract seeks a small business contractor to provide comprehensive CMMC Level 2 compliance support for a Department of Defense entity, with the primary focus on achieving certification through a certified third-party assessment organization. The scope includes conducting a detailed gap analysis to identify disparities between current cybersecurity practices and CMMC Level 2 requirements, developing a robust System Security Plan tailored to the organization’s environment, and actively coordinating with an accredited C3PAO to facilitate and complete the formal assessment process. All work must align with the framework of NIST SP 800-171 and the CMMC model as outlined by the Department of Defense, ensuring full adherence to federal cybersecurity standards for handling controlled unclassified information. Performance is required to be conducted at or in support of the designated location in New Cumberland, Pennsylvania, with all deliverables expected to meet stringent government compliance benchmarks. The solicitation is set aside exclusively for small businesses under the SBA’s Total Small Business Set-Aside program, and responses must be submitted by the deadline specified for consideration. This subcontract opportunity is part of a broader initiative by the ASC Supplier Oper AE and AF Division to enhance cybersecurity readiness across the defense supply chain, emphasizing accountability, documentation, and verified third-party validation of cyber resilience.