Cybersecurity Compliance (CMMC Level 2) Support

The contract seeks support to achieve Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance for safeguarding Controlled Unclassified Information (CDI) by performing a comprehensive gap assessment, developing System Security Plans (SSPs), and implementing the controls outlined in NIST Special Publication 800-171. This effort is critical for ensuring adherence to federal cybersecurity standards required for handling sensitive defense-related data, with the contractor expected to deliver structured, actionable steps to close identified security gaps and align operations with CMMC Level 2 requirements. The work will involve close collaboration with the organization’s existing infrastructure and personnel to institutionalize compliance across technical, administrative, and physical domains. This is a subcontract solicitation under a Total Small Business Set-Aside, meaning only small businesses certified by the Small Business Administration are eligible to respond, and it falls under the NAICS code 541512 for Computer Systems Design Services. The solicitation was posted on July 17, 2026, with a response deadline of July 23, 2026, and is issued by the Department of Defense through its ASC SUPPLIER OPER AE AND AF DIV. Performance will be conducted at an unspecified location, but the work must meet all Defense Industrial Base cybersecurity obligations tied to CMMC accreditation. Participation requires proven experience in cybersecurity compliance frameworks and a clear understanding of NIST 800-171 controls and their application within defense contractor environments.