Cybersecurity Compliance & CMMC Assessment Support

The contract seeks support services to assist the prime contractor in attaining and documenting Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance, with a focus on executing a NIST SP 800-171 gap analysis to identify deficiencies, developing a comprehensive System Security Plan, and managing SPRS reporting to demonstrate compliance status. The work is critical for ensuring the prime contractor meets federal cybersecurity standards required for handling controlled unclassified information, and the efforts must result in auditable documentation ready for third-party assessment. The subcontractor will be expected to provide expert guidance throughout the certification process, aligning security controls with CMMC requirements and maintaining accurate records for verification. Performance of the contract is designated to take place in Jacksonville, Florida, with a deadline for responses on May 18, 2026, and the solicitation was posted on May 13, 2026. This is a subcontract under the Department of Defense, specifically managed by the ASC Commodities Division, and falls under NAICS code 541611 for administrative management and general management consulting services. The requirement is not subject to any specified set-aside categories, and all deliverables must be completed to satisfy the stringent documentation and compliance expectations of CMMC Level 2 without reliance on external certifications until the assessment is formally validated.