AAC-RFP-25-002 AAC For CMMC Level 2 Compliance Service Contract Notice of Intent to Award

Alaska Aerospace Corporation (AAC) is seeking proposals for a Cybersecurity Maturity Model Certification (CMMC) Level 2 Compliance Service Contract, targeting the organization's need to meet Department of Defense (DoD) contractual obligations for handling Controlled Unclassified Information (CUI). The procurement is specifically for the Aleutians East Borough jurisdiction and involves comprehensive cybersecurity services to help AAC achieve and maintain CMMC Level 2 certification. Key deliverables include conducting a gap assessment, developing a remediation plan, implementing 110 NIST SP 800-171 controls, creating system security documentation, preparing for third-party assessment, and providing ongoing compliance support. The project will run approximately from August 1, 2025, to June 2028, with proposals due by 5 PM Alaska Standard Time on July 15, 2025, after a deadline extension. Evaluation criteria will be weighted across technical expertise (40.50%), approach and methodology (25%), cost effectiveness (15.45%), project management (9.55%), and references (5.90%), with the goal of selecting the vendor offering the best overall value.

The contract appears open to registered vendors without specific set-aside designations, though an Alaska Bidder Preference may be applied to vendors meeting state business requirements. The current cybersecurity environment at AAC involves approximately 50 employees and devices, with only a single dedicated IT staff member and an existing but outdated System Security Plan. While a specific budget is not explicitly stated, the contract is structured as a Firm Fixed Price arrangement with payment based on approved progress reports and invoices. Vendors must be prepared to support an organization currently 10-25% ready for CMMC compliance, using Microsoft GCC High and commercial cloud tenants. Professional liability insurance requirements will be scaled based on the contract amount, and all services must be performed within the United States. Potential vendors should have expertise in cybersecurity compliance, technical configurations, documentation development, and implementation of security controls, with the flexibility to provide consulting or direct implementation support.