Cybersecurity Compliance (CMMC Level 2) Assessment Support

The contract seeks a subcontractor to support a prime contractor in achieving Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance, focusing on critical activities such as conducting a self-assessment, developing a System Security Plan (SSP), and aligning cybersecurity practices with NIST SP 800-171 requirements. This engagement is essential for ensuring the prime contractor meets federal standards for protecting controlled unclassified information within the defense supply chain. The work will involve detailed analysis, documentation, and implementation of security controls outlined in the NIST framework, with the goal of preparing the organization for third-party CMMC assessment and certification. The opportunity is posted under the NAICS code 541611, indicating it is an information technology services subcontract, and is tied to the Department of Defense through the Aviation Supply Chain office. Performance is scheduled to take place in New Cumberland, Pennsylvania, with a zip code of 17070-5002. The solicitation was posted on July 14, 2026, and responses are due by July 22, 2026, with the contract type explicitly defined as a subcontract. Although no set-aside details or point of contact information are provided, the requirement is clearly scoped to support CMMC compliance readiness and is critical for maintaining eligibility to handle sensitive defense information.