Cybersecurity Compliance (CMMC Level 2 Self-Assessment)

The contract requires the completion and documentation of a CMMC Level 2 self-assessment for systems that handle Controlled Unclassified Information, ensuring full alignment with DFARS 252.240-7997 and the security requirements outlined in NIST SP 800-171. This effort is focused on demonstrating compliance with cybersecurity controls necessary to protect sensitive federal data within the defense supply chain, with specific emphasis on systems operating at Tinker AFB, Oklahoma. The work must be thoroughly documented to validate adherence to all applicable standards and may involve internal audits, policy reviews, and technical controls implementation across the organization’s information systems. This is a small business set-aside subcontract under NAICS code 541512, exclusively available to qualified small businesses as defined by the SBA. The solicitation was posted on August 3, 2026, with a firm deadline for responses on August 14, 2026, and is managed by the Department of Defense through the Maritime Supply Chain office. Performance is expected to occur at or support operations tied to Tinker AFB, and while no point of contact is listed, all submissions must be made through the designated DIBBS portal. Contractors must be prepared to deliver a complete, auditable self-assessment package that meets federal compliance requirements without external validation, as this is not a third-party assessment but a self-reported compliance effort.