Cybersecurity Compliance Assessment (CMMC Level 2)

A third-party cybersecurity compliance assessment is being sought to verify adherence to CMMC Level 2 requirements and NIST SP 800-171 standards for the handling of Controlled Unclassified Information. This subcontract engagement mandates an independent evaluation by an accredited third-party assessment organization to ensure the contractor’s systems, policies, and practices fully meet the mandatory controls outlined by the Cybersecurity Maturity Model Certification framework. The assessment will focus on confirming the implementation and operation of security controls related to data protection, access control, incident response, and system monitoring as defined by the CMMC-AB guidelines. The solicitation is issued under the Department of Defense’s Maritime Supply Chain ESOC Buys office, with a NAICS code of 541618 for other scientific and technical consulting services. Offers are due by August 10, 2026, and the contract opportunity was posted on July 28, 2026. While no specific place of performance or point of contact is listed, the assessment must be conducted to validate compliance across all relevant systems and processes that handle CUI. The subcontractor must possess current CMMC-AB accreditation and demonstrate proven experience in conducting Level 2 assessments for defense contractors and supply chain partners.