AAC-RFP-25-002 AAC For CMMC Level 2 Compliance Service Contract

Background
The Alaska Aerospace Corporation (AAC) is seeking proposals from qualified vendors to provide Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance services. The goal of this contract is to assist AAC in achieving and maintaining CMMC Level 2 certification to meet Department of Defense (DoD) contractual obligations for handling Controlled Unclassified Information (CUI).

The Pacific Spaceport Complex – Alaska, owned by AAC, serves as a low-cost access point to space and requires compliance with CMMC Level 2 due to its operations involving CUI.

Work Details
The contractor will provide comprehensive CMMC Level 2 compliance services, including:
1. Gap Assessment: Conduct an assessment of current cybersecurity practices against CMMC Level 2 requirements based on NIST SP 800-171 controls.
2. Remediation Planning: Develop a remediation plan addressing identified gaps with prioritized recommendations and cost estimates.
3. Implementation Support: Assist in implementing the 110 NIST SP 800-171 controls and associated Level 2 practices, including technical configurations and policy development.
4. System Security Plan (SSP) and Plan of Action and Milestones (POA&M): Develop or update the SSP for compliance documentation and create a POA&M for tracking remediation progress.
5. Pre-Assessment Preparation: Prepare AAC for a CMMC Level 2 assessment by a Certified Third-Party Assessment Organization (C3PAO), including mock audits and evidence collection.
6. Ongoing Compliance Support: Provide guidance on maintaining CMMC Level 2 compliance post-certification, including monitoring and updates to controls.

Period of Performance
The contract will commence approximately on August 1, 2025, and will last for approximately three years until June 2028.

Place of Performance
The work will be performed at the Pacific Spaceport Complex – Alaska, with the contractor providing its own workspace unless otherwise arranged with AAC.

Bidder Requirements
Offerors must hold a valid Alaska business license prior to the award of the contract. Subcontractors may be used but must be disclosed in the proposal, including their qualifications and licensing status.