Cybersecurity Maturity Model Certification (CMMC) Level 2 Compliance Support

This contract seeks a third-party CMMC Level 2 assessment and certification from an accredited C3PAO to ensure compliance with DoD cybersecurity requirements based on NIST SP 800-171. The scope includes a thorough evaluation of the contractor’s security controls, processes, and documentation to verify adherence to the CMMC Level 2 framework, covering areas such as access control, audit and accountability, configuration management, and incident response. Successful completion of the assessment will result in official CMMC Level 2 certification, a mandatory requirement for handling controlled unclassified information within the defense supply chain. The contract is structured as a subcontract under a Total Small Business Set-Aside, meaning only small businesses classified under NAICS code 541611 are eligible to respond. The solicitation was posted on June 25, 2026, with responses due by July 6, 2026. Performance is expected to occur in Columbus, Ohio, within the 43213 ZIP code. The contracting activity is managed by the Department of Defense’s Active Devices Division, which requires the assessment to be completed in a timely manner to maintain continuity of operations and compliance obligations. The work is critical for sustaining eligibility to support Department of Defense programs and must align precisely with CMMC protocol and reporting standards.