Cybersecurity Compliance (CMMC Level 2 Self-Assessment)

The contract requires the performance of a CMMC Level 2 self-assessment to ensure compliance with cybersecurity requirements for handling Covered Defense Information as mandated by DFARS 252.204-7012 and NIST SP 800-171. This effort is focused on evaluating and documenting the implementation of security controls designed to protect sensitive defense data, with the goal of achieving and maintaining CMMC Level 2 certification readiness. The assessment must be completed in accordance with official CMMC framework guidelines and must address all applicable requirements related to access control, awareness training, audit and accountability, configuration management, and incident response among other domains. This is a small business set-aside subcontract under NAICS code 541512, reserved exclusively for total small businesses as defined by the SBA. The work is performance-based and tied to a specific location in Cherry Point, North Carolina, with a response deadline of July 23, 2026, and a posting date of July 15, 2026. The contracting office is part of the Department of Defense’s ASC Supplier Operations OEM Division, underscoring the critical nature of cybersecurity preparedness within the defense supply chain. Participants must be prepared to demonstrate full alignment with federal cybersecurity standards and provide verifiable evidence of control implementation through the self-assessment process.