26Q3114 Clauses - Full Text.docx

SPMYM326Q3114

With the implementation for the Revolutionary FAR Overhaul (RFO) 2/1/26, many Part 4 (52.204) clauses have been deleted and moved to Part 40 (52.240); additionally, clause 52.212-5 has been deleted.

FAR CLAUSES

52.219-1 Small Business Program Representations (as of RFO 2/1/2026)

(a) Definitions. As used in this provision-

Economically disadvantaged women-owned small business (EDWOSB) concern means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127, and the concern is certified by SBA or an approved third-party certifier in accordance with 13 CFR 127.300. It automatically qualifies as a women-owned small business concern eligible under the WOSB Program.

HUBZone small business concern means a small business concern that meets the requirements described in 13 CFR 126.200, is certified by the Small Business Administration (SBA) and designated by SBA as a HUBZone small business concern in the Small Business Search (SBS) ( 13 CFR 126.103).

Service-disabled veteran-owned small business (SDVOSB) concern eligible under the SDVOSB Program means an SDVOSB concern that is designated in the System for Award Management (SAM) as certified by the Small Business Administration (SBA) in accordance with 13 CFR 128.300.

Small business concern—

(1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in its field of operation, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (b) of this provision.

(2) Affiliates, as used in this definition, means business concerns, one of whom directly or indirectly controls or has the power to control the others, or a third party or parties control or have the power to control the others. In determining whether affiliation exists, consideration is given to all appropriate factors including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103.

Small disadvantaged business concern means a small business concern that-

(1) Is at least 51 percent unconditionally and directly owned (as defined at 13 CFR 124.105) by one or more socially disadvantaged (as defined at 13 CFR 124.103) and economically disadvantaged (as defined at 13 CFR 124.104) individuals who are citizens of the United States, and

(2) The management and daily business operations of which are controlled (as defined at 13 CFR 124.106) by individuals who meet the criteria in paragraph (1) of this definition.

Women-owned small business (WOSB) concern eligible under the WOSB Program (in accordance with 13 CFR part 127) means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States, and the concern is certified by SBA or an approved third-party certifier in accordance with 13 CFR 127.300.

(b)(1) The North American Industry Classification System (NAICS) code for this acquisition is ________ [insert NAICS code].

(2) The small business size standard is _______ [insert size standard].

(3) The small business size standard for a concern that submits an offer, other than on a construction or service acquisition, but proposes to furnish an end item that it did not itself manufacture, process, or produce (i.e., nonmanufacturer), is 500 employees, or 150 employees for information technology value-added resellers under NAICS code 541519, if the acquisition—

(i) Is set aside for small business and has a value above the simplified acquisition threshold;

(ii) Uses the HUBZone price evaluation preference regardless of dollar value, unless the offeror waives the price evaluation preference; or

(iii) Is an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(c) Representations.(1) The offeror represents as part of its offer that—

(i) it □ is, □ is not a small business concern; or

(ii) It □ is, □ is not a small business joint venture that complies with the requirements of 13 CFR 121.103(h) and 13 CFR 125.8(a) and (b). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.]

(2) [Complete only if the offeror represented itself as a small business concern in paragraph (c)(1) of this provision.] The offeror represents that it □ is, □ is not a women-owned small disadvantage business concern.

(3) Women-owned small business (WOSB) joint venture eligible under the WOSB Program. The offeror represents as part of its offer that it □ is, □ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.]

(4) Economically disadvantaged women-owned small business (EDWOSB) joint venture. The offeror represents as part of its offer that it □ is, □ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.]

(5) SDVOSB joint venture eligible under the SDVOSB Program. [Complete only if the offeror is certified as a SDVOSB concern]. The offeror represents as part of its offer that it □ is, □ is not a SDVOSB joint venture eligible under the SDVOSB Program that complies with the requirements of 13 CFR 128.402. [ The offeror shall enter the name and unique entity identifier of each party to the joint venture:__.]

(6) HUBZone joint venture eligible under the HUBZone Program. [Complete only if the offeror is a HUBZone small business concern.] The offeror represents, as part of its offer, that it □ is, □ is not a HUBZone joint venture that complies with the requirements of 13 CFR 126.616(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.] Each HUBZone small business concern participating in the HUBZone joint venture must be certified as a HUBZone concern.

(d) Notice. Under 15 U.S.C. 645(d), any person who misrepresents a firm’s status as a business concern that is small, HUBZone small, small disadvantaged, service-disabled veteran-owned small, economically disadvantaged women-owned small, or women-owned small eligible under the WOSB Program in order to obtain a contract to be awarded under the preference programs established pursuant to section 8, 9, 15, 31, and 36 of the Small Business Act or any other provision of Federal law that specifically references section 8(d) for a definition of program eligibility, will be—

(1) Punished by imposition of fine, imprisonment, or both;

(2) Subject to administrative remedies, including suspension and debarment; and

(3) Ineligible for participation in programs conducted under the authority of the Act.

(End of provision)

52.204-90 Offeror Identification.

As prescribed in 4.208(c)(1), insert the following provision:

Offeror Identification

If the Offeror will not have an active Federal Government contracts registration in the System for Award Management (https://www.sam.gov) when submitting its offer, it shall complete paragraphs (c) and (d) of this provision and include its responses with its offer.

(a) Definitions. As used in this provision—

Commercial and Government Entity (CAGE) code has the meaning provided in the clause at FAR 52.204-91, Contractor Identification, of this solicitation.

Common parent means that corporate entity that owns or controls an affiliated group of corporations that files its Federal income tax returns on a consolidated basis, and of which the offeror is a member.

Electronic Funds Transfer (EFT) indicator means a bank account identifier to establish additional System for Award Management records for identifying alternative EFT accounts (see part 32) for the same entity.

Highest-level owner means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest-level owner.

Immediate owner means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees. There may be more than one immediate owner (e.g., joint ventures).

Predecessor means an entity whose assets were acquired by the offeror or another entity (most often through merger or acquisition) and whose affairs are now carried out by the offeror or the other entity under a new name.

Taxpayer Identification Number means the number required by the Internal Revenue Service (IRS) to be used by the offeror to report income tax and other returns. It may be either a Social Security Number or an Employer Identification Number.

Unique entity identifier (UEI) has the meaning provided in the clause at FAR 52.204-91, Contractor Identification, of this solicitation.

(b) Unique entity identifier (UEI).

(1) The Offeror shall enter, in the block with its name and address on the cover page of its offer, the annotation “Unique Entity Identifier” followed by the UEI that identifies the Offeror's name and address exactly as stated in the offer. The Offeror shall also enter its EFT indicator, if applicable.

(2) If the Offeror does not have a UEI, it shall go to https://www.sam.gov to obtain one. The Government will independently validate the existence and uniqueness of the Offeror before assigning a UEI.

(c) Taxpayer identification. The Offeror shall provide with its offer the following information that is necessary to comply with debt collection requirements of 31 U.S.C. 7701(c) and 3325(d); reporting requirements of 26 U.S.C. 6041, 6041A, and 6050M; and the implementing IRS regulations:

(1) Taxpayer identification number (TIN)

□ TIN: ______________;

□ TIN has been applied for; or

□ TIN is not required because:

□ Offeror is a nonresident alien, foreign corporation, or foreign partnership that does not have income effectively connected with the conduct of a trade or business in the United States and does not have an office or place of business or a fiscal paying agent in the United States;

□ Offeror is an agency or instrumentality of a foreign government; or

□ Offeror is an agency or instrumentality of the Federal Government.

(2) Type of organization.

□ Sole proprietorship;

□ Partnership;

□ Corporate entity (not tax-exempt);

□ Corporate entity (tax-exempt);

□ Government entity (Federal, State, or local);

□ Foreign government;

□ International organization per 26 CFR 1.6049-4; or

□ Other.

(3) Common parent.

□ Offeror is not owned or controlled by a common parent as defined in paragraph (a) of this provision; or

□ Name and TIN of common parent:

Name: ______________

TIN: ______________

(4) The TIN provided in paragraph (c)(1) of this provision may be matched with IRS records to verify the accuracy of the Offeror's TIN. The Government may use the TIN to collect and report on any delinquent amounts arising out of the Offeror's relationship with the Government (31 U.S.C. 7701(c)(3)).

(d) Commercial and Government Entity (CAGE) code.

(1) The Offeror shall provide its CAGE code with its offer with its name and location address or otherwise include it prominently in its offer. The CAGE code shall be for that name and location address. Insert the word “CAGE” before the code. The Offeror may obtain a CAGE code as indicated in the following table.

(2) The Offeror shall provide the CAGE code and legal business name (Do not use a “doing business as” name) for—

(i) Its immediate owner(s), if any;

(ii) Its highest-level owner, if any; and

(iii) Any predecessor(s), or predecessor of an Offeror’s predecessor, that held a Federal contract or grant within the last three years.

Immediate owner

Highest-level owner

Predecessor*

* Predecessor CAGE code may be marked “Unknown.”

(3) If the Offeror has more than one immediate owner (such as a joint venture), give the information for each owner (or joint venture participant). If the Offeror has more than one predecessor, provide information for each predecessor in reverse chronological order.

52.204-91 Contractor Identification.

As prescribed in 4.208(c)(2), insert the following clause:

Contractor Identification

Definitions. As used in this clause—

Commercial and Government Entity code means—

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location (referred to as “CAGE code”); or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA CAGE Branch records and maintains in the CAGE master file (referred to as “NCAGE code”).

Unique entity identifier means an identifier used to identify a specific commercial, nonprofit, or Government entity.

(b) Unique entity identifier (UEI). The Contractor shall ensure that its UEI is maintained throughout the life of the contract.

(c) Commercial and Government Entity (CAGE) code. The Contractor shall ensure that the CAGE code is maintained throughout the life of the contract. The Contractor shall request changes to a CAGE code as indicated in the following table.

(d) Communicating changes. The Contractor shall communicate any change to its UEI or CAGE code to the Contracting Officer within 30 days after the change, so a modification can be issued to update the UEI or CAGE code on this contract. A change in the UEI does not necessarily require a novation.

(End of clause)

52.240-92 Security Requirements.

As prescribed in 40.302-3, insert the following clause:

Security Requirements

(a) This clause applies to the extent that this contract involves access to information classified Confidential, Secret, or Top Secret.

(b) The Contractor shall comply with—

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (32 CFR part 117); and

(2) Any revisions to that manual, notice of which has been furnished to the Contractor.

(c) If, after the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract must be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract

(d) The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

(e) A subcontractor requiring access to classified information under a contract shall be identified with a CAGE code on the DD Form 254. The Contractor shall require a subcontractor requiring access to classified information to provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and location address. Insert the word “CAGE” before the number. The CAGE code is required prior to award. The contractor shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract.

52.240-93 Basic Safeguarding of Covered Contractor Information Systems.

As prescribed in 40.303-2, insert the following clause:

Basic Safeguarding of Covered Contractor Information Systems (Deviation Date)

(a) Definitions. As used in this clause— Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information—

(1) Means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government; but

(2) Does not include information provided by the Government to the public (such as on public websites) or simple transactional information (such as information necessary to process payments).

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements.

(1) Basic requirements. The Contractor shall safeguard its covered contractor information systems by implementing, at minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal departments and agencies relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products, other than commercially available off-the-shelf items, or commercial services), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

52.252-2 Clauses Incorporated by Reference.

Clauses Incorporated By Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

FAR Clauses:

https://www.acquisition.gov/browse/index/far/ DFARS Clauses:

http://www.acq.osd.mil/dpap/dars/dfarspgi/current/

RFO

https://www.acquisition.gov/far-overhaul/far-part-deviation-guide

DFARS CLAUSES

252.204-7016 COVERED DEFENSE TELECOMMUNICATIONS EQUIPMENT OR SERVICES --

REPRESENTATION (DEC 2019)

(a) Definitions. As used in this provision, covered defense telecommunications equipment or services has the meaning provided in the clause 252.204-7018, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

(b) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for “covered defense telecommunications equipment or services”.

(c) Representation. The Offeror represents that it [ ] does, [ ] does not provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument.

252.204-7019 NOTICE OF NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (MAR 2022)

(a) Definitions.

Basic Assessment, Medium Assessment, and High Assessment have the meaning given in the clause 252.204-7020, NIST SP 800-171 DoD Assessments.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this solicitation.

(b) Requirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment Methodology located at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171.

(c) Procedures.

(1) The Offeror shall verify that summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) are posted in the Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) for all covered contractor information systems relevant to the offer.

(2) If the Offeror does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the Offeror may conduct and submit a Basic Assessment to webptsmh@navy.mil for posting to SPRS in the format identified in paragraph (d) of this provision.

(d) Summary level scores. Summary level scores for all assessments will be posted 30 days post-assessment in SPRS to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. An Offeror may follow the procedures in paragraph (c)(2) of this provision for posting Basic Assessments to SPRS.

(i) The email shall include the following information:

(A) Cybersecurity standard assessed (e.g., NIST SP 800-171 Rev 1).

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract--

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (d)(1)(i) of this section, the Offeror shall use the following format for the report:

Brief CAGE codes description of Date of Total Date score of System security plan supported by this the plan assessment score 110 will plan architecture achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(3) Accessibility.

(i) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information (PI).

(ii) Authorized representatives of the Offeror for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(iii) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this section. DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

252.204-7020 NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (MAR 2022)

(a) Definitions.

Basic Assessment means a contractor's self-assessment of the contractor's implementation of NIST SP 800-171 that-

(1) Is based on the Contractor's review of their system security plan(s) associated with covered contractor information system(s);

(2) Is conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology; and

(3) Results in a confidence level of "Low" in the resulting score, because it is a self-generated score.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

High Assessment means an assessment that is conducted by Government personnel using NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review;

(iii) Verification, examination, and demonstration of a Contractor's system security plan to validate that NIST SP 800-171 security requirements have been implemented as described in the contractor's system security plan; and

(iv) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "High" in the resulting score.

Medium Assessment means an assessment conducted by the Government that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review; and

(iii) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "Medium" in the resulting score.

(b) Applicability. This clause applies to covered contractor information systems that are required to comply with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, in accordance with Defense Federal Acquisition Regulation System (DFARS) clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

(c) Requirements. The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, as described in NIST SP 800-171 DoD Assessment Methodology at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171, if necessary.

(d) Procedures. Summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. A contractor may submit, via encrypted email, summary level scores of Basic Assessments conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology to webptsmh@navy.mil for posting to SPRS.

(i) The email shall include the following information:

(A) Version of NIST SP 800-171 against which the assessment was conducted.

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract--

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (b)(1)(i) of this section, the Contractor shall use the following format for the report:

Brief CAGE codes description of Date of Total Date score of System security plan supported by this the plan assessment score 110 will plan architecture achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system security plan assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(e) Rebuttals. (1) DoD will provide Medium and High Assessment summary level scores to the Contractor and offer the opportunity for rebuttal and adjudication of assessment summary level scores prior to posting the summary level scores to SPRS (see SPRS User's Guide https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf).

(2) Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

(f) Accessibility.

(1) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information (PI).

(2) Authorized representatives of the Contractor for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(3) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this clause. DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

(g) Subcontracts.

(1) The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items (excluding COTS items).

(2) The Contractor shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST SP 800-171 security requirements, in accordance with DFARS clause 252.204-7012 of this contract, unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171 DoD Assessment, as described in https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171, for all covered contractor information systems relevant to its offer that are not part of an information technology service or system operated on behalf of the Government.

(3) If a subcontractor does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the subcontractor may conduct and submit a Basic Assessment, in accordance with the NIST SP 800-171 DoD Assessment Methodology, to webptsmh@navy.mil for posting to SPRS along with the information required by paragraph (d) of this clause.

DLAD CLAUSES

52.233-9001, DISPUTES – AGREEMENT TO USE ALTERNATIVE DISPUTE RESOLUTION (DEC 2016)

(a) The parties agree to negotiate with each other to try to resolve any disputes that may arise. If unassisted negotiations are unsuccessful, the parties will use alternative dispute resolution (ADR) techniques to try to resolve the dispute. Litigation will only be considered as a last resort when ADR is unsuccessful or has been documented by the party rejecting ADR to be inappropriate for resolving the dispute.

(b) Before either party determines ADR inappropriate, that party must discuss the use of ADR with the other party. The documentation rejecting ADR must be signed by an official authorized to bind the contractor (see FAR 52.233-1), or, for the Agency, by the contracting officer, and approved at a level above the contracting officer after consultation with the ADR Specialist and legal counsel. Contractor personnel are also encouraged to include the ADR Specialist in their discussions with the contracting officer before determining ADR to be inappropriate.

(c) If you wish to opt out of this clause, check here [ ]. Alternate wording may be negotiated with the contracting officer.

(End of Provision)

DLA PROC NOTES

C01 Superseded Part Numbered Items (SEP 2016)

If an item part number is superseded during the term of this contract, the contractor shall advise the contracting officer immediately upon determination. The notice shall include complete information on the superseding item form, fit, function, configuration, application, or physical nature. The contracting officer will determine whether the item is acceptable to the Government, advise the contractor within seven days, and modify the contract accordingly.

C02 Manufacturing Phase-Out or Discontinuation of Production, Diminishing Sources, and Obsolete Materials or Components (DEC 2016)

The contractor shall notify the contracting officer immediately upon determining the unavailability of obsolete materials or components. The contractor may recommend a solution to include the impact on the contract price and delivery. The contractor shall not initiate any item redesign or incur any additional costs without the express, written authorization of the contracting officer. In the event that manufacturing phase-out or discontinuance of production of such items is contemplated, the contractor is required to notify the contracting officer and publish the discontinuance in the Government-Industry Data Exchange Program (GIDEP), where feasible; and to provide immediate advance notice of production phase-out to DLA DMSMS at dscc.dmsms@dla.mil.

C03 Contractor Retention of Supply Chain Traceability Documentation (JUN 2023)

(http://www.dla.mil/LandandMaritime/Business/Selling/Counterfeit-Detection-Avoidance-Program/ ).

(4) The contractor shall immediately make documentation available to the contracting officer upon request. The contracting officer determines the acceptability and sufficiency of documentation. The contractor shall retain supply chain traceability documentation for six years after final payment under this contract for audit and other valid government purposes. If the contractor fails to retain or provide the documentation, or the contracting officer finds the documentation to be unacceptable, the contracting officer may take corrective action, including, but not limited to, cancellation of undelivered orders or rejection of delivered supplies.

C04 Unused Former Government Surplus Property (SEP 2021)

To be considered for award, the offeror must complete and submit the following representation with their offer. Additional supporting documentation to demonstrate the surplus material offered was previously owned by the Government and meets solicitation requirements must be provided within 24 hours of request by the contracting officer.

(1) The material is new, unused, and not of such age or so deteriorated as to impair its usefulness or safety.

Yes [__] No [__] The material conforms to the technical requirements cited in the solicitation (e.g., Commercial and Government Entity (CAGE) Code and part number, specification, etc.). Yes [__] No [__] The material conforms to the revision letter/number, if any is cited. Yes [__] No [__] Unknown __ If No, the revision does not affect form, fit, function, or interface. Yes__ No __ Unknown __ The material was manufactured by:

(Name): ______________________________________________________________________ (Address): ___________________________________________________________________

(2) The offeror currently possesses the material Yes __ No __ If yes, the offeror purchased the material from a Government selling agency or other source.

Yes __ No __ If yes, complete the following:

Government Selling Agency: ___________________________________________________ Contract Number: ____________________________________________________________ Contract Date: (Month, Year): __________________________________________________ Other Source: ________________________________________________________________ Address: ____________________________________________________________________ Date Acquired: (Month/Year) ___________________________________________________

(3) The material has been altered or modified. Yes __ No __ If Yes, complete the following:

Name of the company that performed the alternation or modification:

[(Address): __________________________________________________________________ Complete description of the alterations or modifications.

(4) The material has been reconditioned. Yes __ No __ If Yes, complete the following:

(i) The price offered includes the cost of reconditioning /refurbishment. Yes __ No __

(ii) Name of the company that reconditioned the material.

(iii) Description of any work done or to be done, including the components to be replaced and the applicable rebuild standard.

The material contains cure-dated components. Yes __ No __ If Yes, complete the following:

(6) The offered material is in its original package. Yes __ No __ If yes, complete the following:

Contract Number ______________________________________________________________

NSN_________________________________________________________________________

CAGE Code__________________________________________________________________ Part Number __________________________________________________________________ Other Markings/Data___________________________________________________________

(7) The offeror has supplied this same material (National Stock Number) to the Government before.

Yes __ No __ If Yes, complete the following:

Agency ______________________________________________________________________ Contract Number_______________________________________________________________

(8) The material is manufactured in accordance with a specification or drawing. Yes __ No __ If Yes, complete the following:

Specification/Drawing Number ___________________________________________________ Revision (if any) _______________________________________________________________ Date__________________________________________________________________________

(9) The material has been inspected for correct part number and for absence of corrosion or any obvious defects.

Yes __ No __ If Yes, complete the following:

The offeror agrees that in the event of award and notwithstanding the provisions of the solicitation, inspection and acceptance of the surplus material will be performed at source or destination subject to all applicable provisions for source or destination inspection.

The offeror will forward one of the following, within 24 hours of request by the contracting officer, to demonstrate that the material being offered was previously owned by the Government (offeror check which one applies):

___ For national or local sales, conducted by sealed bid, spot bid or auction methods, a solicitation/Invitation For Bid and corresponding DLA Disposition Services Form 1427, Notice of Award, Statement and Release Document.

___ For DLA Disposition Services Commercial Venture (CV) Sales, the shipment receipt/delivery pass document and invoices/receipts used by the original purchaser to resell the material.

___ When the above documents are not available, or if they do not identify the specific NSN being acquired, a copy or facsimile of all original package markings and data, including NSN, commercial and Government entity (CAGE) code and part number, and original contract number. (This information has already been provided in paragraph (6) of this procurement note Yes __ No __) ___ When none of the above are available, other information to demonstrate that the offered material was previously owned by the Government. Describe:

This procurement note only applies to offers of Government surplus material. Offers of commercial surplus, manufacturer’s overruns, residual inventory resulting from terminated Government contracts, and any other material that meets the technical requirements in the solicitation but was not previously owned by the Government will be evaluated in accordance with the DLAD procurement note L04, Offers for Part Numbered Items.

If requested by the contracting officer, the offeror shall furnish sample units, in the number specified, to the contracting officer or to another location specified by the contracting officer, within 10 days after the contracting officer's request. The samples will be furnished at no cost to the Government. All such samples not destroyed in evaluation will be returned at the offeror's expense. The samples will be evaluated for form, fit, and function with subassembly, assembly, or equipment with which the items are to be used. End items furnished under any contract award to the offeror furnishing the samples can include the returned samples, and all acceptable end items will have a configuration identical to the samples. If specific tests of the samples' performance are made by the Government, the offeror will be furnished the results of such tests prior to a contract being entered into. In addition to any other inspection examinations and tests required by the contract, the performance of the end items will be required to be as good as that of the samples submitted.

In the event of award, the contractor will be responsible for providing material that is in full compliance with all requirements in the contract or order. The surplus material to be furnished must meet the requirements of the current contract or order, whether or not the material met Government requirements in existence at the time the material was initially manufactured or sold to the Government. If higher-level contract quality requirements apply to the material being acquired, those requirements do not apply to surplus material furnished under this contract.

C07 Warstopper Program Material Buffer Availability (JAN 2021)