26Q3142 Clauses - Full Text -CMMC 2.docx

6/9/26 QA4

With the implementation for the Revolutionary FAR Overhaul (RFO) 2/1/26, many Part 4 (52.204) clauses have been deleted and moved to Part 40 (52.240); additionally, clause 52.212-5 has been deleted.

FAR CLAUSES

52.219-1 Small Business Program Representations (as of RFO 2/1/2026)

(a) Definitions. As used in this provision-

Economically disadvantaged women-owned small business (EDWOSB) concern means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127, and the concern is certified by SBA or an approved third-party certifier in accordance with 13 CFR 127.300. It automatically qualifies as a women-owned small business concern eligible under the WOSB Program.

HUBZone small business concern means a small business concern that meets the requirements described in 13 CFR 126.200, is certified by the Small Business Administration (SBA) and designated by SBA as a HUBZone small business concern in the Small Business Search (SBS) ( 13 CFR 126.103).

Service-disabled veteran-owned small business (SDVOSB) concern eligible under the SDVOSB Program means an SDVOSB concern that is designated in the System for Award Management (SAM) as certified by the Small Business Administration (SBA) in accordance with 13 CFR 128.300.

Small business concern—

(1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in its field of operation, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (b) of this provision.

(2) Affiliates, as used in this definition, means business concerns, one of whom directly or indirectly controls or has the power to control the others, or a third party or parties control or have the power to control the others. In determining whether affiliation exists, consideration is given to all appropriate factors including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103.

Small disadvantaged business concern means a small business concern that-

(1) Is at least 51 percent unconditionally and directly owned (as defined at 13 CFR 124.105) by one or more socially disadvantaged (as defined at 13 CFR 124.103) and economically disadvantaged (as defined at 13 CFR 124.104) individuals who are citizens of the United States, and

(2) The management and daily business operations of which are controlled (as defined at 13 CFR 124.106) by individuals who meet the criteria in paragraph (1) of this definition.

Women-owned small business (WOSB) concern eligible under the WOSB Program (in accordance with 13 CFR part 127) means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States, and the concern is certified by SBA or an approved third-party certifier in accordance with 13 CFR 127.300.

(b)(1) The North American Industry Classification System (NAICS) code for this acquisition is ________ [insert NAICS code].

(2) The small business size standard is _______ [insert size standard].

(3) The small business size standard for a concern that submits an offer, other than on a construction or service acquisition, but proposes to furnish an end item that it did not itself manufacture, process, or produce (i.e., nonmanufacturer), is 500 employees, or 150 employees for information technology value-added resellers under NAICS code 541519, if the acquisition—

(i) Is set aside for small business and has a value above the simplified acquisition threshold;

(ii) Uses the HUBZone price evaluation preference regardless of dollar value, unless the offeror waives the price evaluation preference; or

(iii) Is an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(c) Representations.(1) The offeror represents as part of its offer that—

(i) it □ is, □ is not a small business concern; or

(ii) It □ is, □ is not a small business joint venture that complies with the requirements of 13 CFR 121.103(h) and 13 CFR 125.8(a) and (b). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.]

(2) [Complete only if the offeror represented itself as a small business concern in paragraph (c)(1) of this provision.] The offeror represents that it □ is, □ is not a women-owned small disadvantage business concern.

(3) Women-owned small business (WOSB) joint venture eligible under the WOSB Program. The offeror represents as part of its offer that it □ is, □ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.]

(4) Economically disadvantaged women-owned small business (EDWOSB) joint venture. The offeror represents as part of its offer that it □ is, □ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.]

(5) SDVOSB joint venture eligible under the SDVOSB Program. [Complete only if the offeror is certified as a SDVOSB concern]. The offeror represents as part of its offer that it □ is, □ is not a SDVOSB joint venture eligible under the SDVOSB Program that complies with the requirements of 13 CFR 128.402. [ The offeror shall enter the name and unique entity identifier of each party to the joint venture:__.]

(6) HUBZone joint venture eligible under the HUBZone Program. [Complete only if the offeror is a HUBZone small business concern.] The offeror represents, as part of its offer, that it □ is, □ is not a HUBZone joint venture that complies with the requirements of 13 CFR 126.616(a) through (c). [ The offeror shall enter the name and unique entity identifier of each party to the joint venture: __.] Each HUBZone small business concern participating in the HUBZone joint venture must be certified as a HUBZone concern.

(d) Notice. Under 15 U.S.C. 645(d), any person who misrepresents a firm’s status as a business concern that is small, HUBZone small, small disadvantaged, service-disabled veteran-owned small, economically disadvantaged women-owned small, or women-owned small eligible under the WOSB Program in order to obtain a contract to be awarded under the preference programs established pursuant to section 8, 9, 15, 31, and 36 of the Small Business Act or any other provision of Federal law that specifically references section 8(d) for a definition of program eligibility, will be—

(1) Punished by imposition of fine, imprisonment, or both;

(2) Subject to administrative remedies, including suspension and debarment; and

(3) Ineligible for participation in programs conducted under the authority of the Act.

(End of provision)

52.204-90 Offeror Identification.

As prescribed in 4.208(c)(1), insert the following provision:

Offeror Identification

If the Offeror will not have an active Federal Government contracts registration in the System for Award Management (https://www.sam.gov) when submitting its offer, it shall complete paragraphs (c) and (d) of this provision and include its responses with its offer.

(a) Definitions. As used in this provision—

Commercial and Government Entity (CAGE) code has the meaning provided in the clause at FAR 52.204-91, Contractor Identification, of this solicitation.

Common parent means that corporate entity that owns or controls an affiliated group of corporations that files its Federal income tax returns on a consolidated basis, and of which the offeror is a member.

Electronic Funds Transfer (EFT) indicator means a bank account identifier to establish additional System for Award Management records for identifying alternative EFT accounts (see part 32) for the same entity.

Highest-level owner means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest-level owner.

Immediate owner means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees. There may be more than one immediate owner (e.g., joint ventures).

Predecessor means an entity whose assets were acquired by the offeror or another entity (most often through merger or acquisition) and whose affairs are now carried out by the offeror or the other entity under a new name.

Taxpayer Identification Number means the number required by the Internal Revenue Service (IRS) to be used by the offeror to report income tax and other returns. It may be either a Social Security Number or an Employer Identification Number.

Unique entity identifier (UEI) has the meaning provided in the clause at FAR 52.204-91, Contractor Identification, of this solicitation.

(b) Unique entity identifier (UEI).

(1) The Offeror shall enter, in the block with its name and address on the cover page of its offer, the annotation “Unique Entity Identifier” followed by the UEI that identifies the Offeror's name and address exactly as stated in the offer. The Offeror shall also enter its EFT indicator, if applicable.

(2) If the Offeror does not have a UEI, it shall go to https://www.sam.gov to obtain one. The Government will independently validate the existence and uniqueness of the Offeror before assigning a UEI.

(c) Taxpayer identification. The Offeror shall provide with its offer the following information that is necessary to comply with debt collection requirements of 31 U.S.C. 7701(c) and 3325(d); reporting requirements of 26 U.S.C. 6041, 6041A, and 6050M; and the implementing IRS regulations:

(1) Taxpayer identification number (TIN)

□ TIN: ______________;

□ TIN has been applied for; or

□ TIN is not required because:

□ Offeror is a nonresident alien, foreign corporation, or foreign partnership that does not have income effectively connected with the conduct of a trade or business in the United States and does not have an office or place of business or a fiscal paying agent in the United States;

□ Offeror is an agency or instrumentality of a foreign government; or

□ Offeror is an agency or instrumentality of the Federal Government.

(2) Type of organization.

□ Sole proprietorship;

□ Partnership;

□ Corporate entity (not tax-exempt);

□ Corporate entity (tax-exempt);

□ Government entity (Federal, State, or local);

□ Foreign government;

□ International organization per 26 CFR 1.6049-4; or

□ Other.

(3) Common parent.

□ Offeror is not owned or controlled by a common parent as defined in paragraph (a) of this provision; or

□ Name and TIN of common parent:

Name: ______________

TIN: ______________

(4) The TIN provided in paragraph (c)(1) of this provision may be matched with IRS records to verify the accuracy of the Offeror's TIN. The Government may use the TIN to collect and report on any delinquent amounts arising out of the Offeror's relationship with the Government (31 U.S.C. 7701(c)(3)).

(d) Commercial and Government Entity (CAGE) code.

(1) The Offeror shall provide its CAGE code with its offer with its name and location address or otherwise include it prominently in its offer. The CAGE code shall be for that name and location address. Insert the word “CAGE” before the code. The Offeror may obtain a CAGE code as indicated in the following table.

(2) The Offeror shall provide the CAGE code and legal business name (Do not use a “doing business as” name) for—

(i) Its immediate owner(s), if any;

(ii) Its highest-level owner, if any; and

(iii) Any predecessor(s), or predecessor of an Offeror’s predecessor, that held a Federal contract or grant within the last three years.

Immediate owner

Highest-level owner

Predecessor*

* Predecessor CAGE code may be marked “Unknown.”

(3) If the Offeror has more than one immediate owner (such as a joint venture), give the information for each owner (or joint venture participant). If the Offeror has more than one predecessor, provide information for each predecessor in reverse chronological order.

52.204-91 Contractor Identification.

As prescribed in 4.208(c)(2), insert the following clause:

Contractor Identification

Definitions. As used in this clause—

Commercial and Government Entity code means—

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location (referred to as “CAGE code”); or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA CAGE Branch records and maintains in the CAGE master file (referred to as “NCAGE code”).

Unique entity identifier means an identifier used to identify a specific commercial, nonprofit, or Government entity.

(b) Unique entity identifier (UEI). The Contractor shall ensure that its UEI is maintained throughout the life of the contract.

(c) Commercial and Government Entity (CAGE) code. The Contractor shall ensure that the CAGE code is maintained throughout the life of the contract. The Contractor shall request changes to a CAGE code as indicated in the following table.

(d) Communicating changes. The Contractor shall communicate any change to its UEI or CAGE code to the Contracting Officer within 30 days after the change, so a modification can be issued to update the UEI or CAGE code on this contract. A change in the UEI does not necessarily require a novation.

(End of clause)

52.240-92 Security Requirements.

As prescribed in 40.302-3, insert the following clause:

Security Requirements

(a) This clause applies to the extent that this contract involves access to information classified Confidential, Secret, or Top Secret.

(b) The Contractor shall comply with—

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (32 CFR part 117); and

(2) Any revisions to that manual, notice of which has been furnished to the Contractor.

(c) If, after the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract must be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract

(d) The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

(e) A subcontractor requiring access to classified information under a contract shall be identified with a CAGE code on the DD Form 254. The Contractor shall require a subcontractor requiring access to classified information to provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and location address. Insert the word “CAGE” before the number. The CAGE code is required prior to award. The contractor shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract.

52.240-93 Basic Safeguarding of Covered Contractor Information Systems.

As prescribed in 40.303-2, insert the following clause:

Basic Safeguarding of Covered Contractor Information Systems (Deviation Date)

(a) Definitions. As used in this clause— Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information—

(1) Means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government; but

(2) Does not include information provided by the Government to the public (such as on public websites) or simple transactional information (such as information necessary to process payments).

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements.

(1) Basic requirements. The Contractor shall safeguard its covered contractor information systems by implementing, at minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal departments and agencies relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products, other than commercially available off-the-shelf items, or commercial services), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

52.252-2 Clauses Incorporated by Reference.

Clauses Incorporated By Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

FAR Clauses:

https://www.acquisition.gov/browse/index/far/ DFARS Clauses:

http://www.acq.osd.mil/dpap/dars/dfarspgi/current/

RFO

https://www.acquisition.gov/far-overhaul/far-part-deviation-guide

DFARS CLAUSES

252.204-7016 COVERED DEFENSE TELECOMMUNICATIONS EQUIPMENT OR SERVICES --

REPRESENTATION (DEC 2019)

(a) Definitions. As used in this provision, covered defense telecommunications equipment or services has the meaning provided in the clause 252.204-7018, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

(b) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for “covered defense telecommunications equipment or services”.

(c) Representation. The Offeror represents that it [ ] does, [ ] does not provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument.

252.204-7019 NOTICE OF NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (MAR 2022)

252.204-7020 NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (MAR 2022)

252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement (NOV 2025)

(a) Definitions. As used in this clause—

“Controlled unclassified information” means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

“Current” means—

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status—

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status—

(i) Not older than 1 year for Final Level 1 (Self), with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

“Cybersecurity Maturity Model Certification (CMMC) status” means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

“Cybersecurity Maturity Model Certification unique identifier (CMMC UID)” means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in theSupplier Performance Risk System (SPRS) for each contractor information system.

“Federal contract information (FCI)” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

“Plan of action and milestones” means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication 800-115 (32 CFR 170.21).

(b) Framework. The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor’s compliance with applicable information security protections (see 32 CFR part 170).

(c) Duplication. The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances when a reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) Requirements. The Contractor shall—

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: ____________ [Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC) ] for all information systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level requiredin paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current,an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis,an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) Reporting. The Contractor shall—

(1) Submit to the Contracting Officer—

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract; and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2)Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) Subcontracts. The Contractor shall—

(1) Insert the substance of this clause, including this paragraph ( f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products and commercial services, excluding commercially available off-the-shelf items , if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.

252.204-7025 Notice of Cybersecurity Maturity Model Certification Level Requirements (NOV 2025)

(a) Definitions. As used in this provision, “controlled unclassified information (CUI),” “current,” “Cybersecurity Maturity Model Certification (CMMC) status,” “Cybersecurity Maturity Model Certification unique identifier (CMMC UID),” “Federal contract information (FCI)”, and “plan of action and milestones” have the meaning given in the Defense Federal Acquisition Regulation Supplement 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, clause of this solicitation.

(b)(1) Cybersecurity Maturity Model Certification (CMMC) level.

The CMMC level required by this solicitation is: _____CMMC Level 2 Self_______ Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC). This CMMC level, or higher (see 32 CFR part 170), is required prior to award for each contractor information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the contract.

(2) The Offeror will not be eligible for award of a contract, task order, or delivery order resulting from this solicitation if the Offeror does not have, for each of the contractor information systems that will process, store, or transmit FCI or CUI and that will be used in performance of a contract resulting from this solicitation—

(i) The current CMMC status entered in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) at the CMMC level required by paragraph (b)(1) of this provision; and

(ii) A current affirmation of continuous compliance with the security requirements identified at 32 CFR part 170 in SPRS.

(c) Plan of action and milestones. If the Offeror has a CMMC Status of Conditional, the Offeror shall successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(d) CMMC unique identifiers. The Offeror shall provide, in the proposal, the CMMC unique identifier(s) (CMMC UIDs) issued by SPRS for each contractor information system that will process, store, or transmit FCI or CUI during performance of a contract, task order, or delivery order resulting from this solicitation. The Offeror also shall update the list when new CMMC UIDs are generated in SPRS. The CMMC UIDs are provided in SPRS after the Offeror enters the results of self-assessment(s) for each such information system.

252.240-7997 NIST SP 800-171 DoD Assessment Requirements. (DEVIATION 2026-O0025)(FEB 2026) As prescribed in 240.370-5, use the following clause:

(a) Definitions.

(b) Applicability. This clause applies to covered contractor information systems that are required to comply with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, in accordance with Defense Federal Acquisition Regulation System (DFARS) clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

(c) Requirements. The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, using the methodology described at 32 CFR 170.24, if necessary. The results of Medium or High NIST SP 800-171 DoD Assessments, when conducted by DCMA, will take precedence over any other assessment, in accordance with 32 CFR 170.16(a)(1)(iv), 32 CFR 170.17(a)(1)(iv), and 32 CFR 170.18(a)(1)(iv).

(d) Procedures. Summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

(e) Rebuttals. (1) DoD will provide Medium and High Assessment summary level scores to the Contractor and offer the opportunity for rebuttal and adjudication of assessment summary level scores prior to posting the summary level scores to SPRS (see SPRS User's Guide https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf).

(2) Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

(f) Accessibility. (1) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information (PI).

(g) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services (excluding commercially available off-the-shelf items).

DLAD CLAUSES

52.233-9001, DISPUTES – AGREEMENT TO USE ALTERNATIVE DISPUTE RESOLUTION (DEC 2016)

(a) The parties agree to negotiate with each other to try to resolve any disputes that may arise. If unassisted negotiations are unsuccessful, the parties will use alternative dispute resolution (ADR) techniques to try to resolve the dispute. Litigation will only be considered as a last resort when ADR is unsuccessful or has been documented by the party rejecting ADR to be inappropriate for resolving the dispute.

(b) Before either party determines ADR inappropriate, that party must discuss the use of ADR with the other party. The documentation rejecting ADR must be signed by an official authorized to bind the contractor (see FAR 52.233-1), or, for the Agency, by the contracting officer, and approved at a level above the contracting officer after consultation with the ADR Specialist and legal counsel. Contractor personnel are also encouraged to include the ADR Specialist in their discussions with the contracting officer before determining ADR to be inappropriate.

(c) If you wish to opt out of this clause, check here [ ]. Alternate wording may be negotiated with the contracting officer.

(End of Provision)

DLA PROC NOTES

C01 Superseded Part Numbered Items (SEP 2016)

If an item part number is superseded during the term of this contract, the contractor shall advise the contracting officer immediately upon determination. The notice shall include complete information on the superseding item form, fit, function, configuration, application, or physical nature. The contracting officer will determine whether the item is acceptable to the Government, advise the contractor within seven days, and modify the contract accordingly.

C02 Manufacturing Phase-Out or Discontinuation of Production, Diminishing Sources, and Obsolete Materials or Components (DEC 2016)

The contractor shall notify the contracting officer immediately upon determining the unavailability of obsolete materials or components. The contractor may recommend a solution to include the impact on the contract price and delivery. The contractor shall not initiate any item redesign or incur any additional costs without the express, written authorization of the contracting officer. In the event that manufacturing phase-out or discontinuance of production of such items is contemplated, the contractor is required to notify the contracting officer and publish the discontinuance in the Government-Industry Data Exchange Program (GIDEP), where feasible; and to provide immediate advance notice of production phase-out to DLA DMSMS at dscc.dmsms@dla.mil.

C03 Contractor Retention of Supply Chain Traceability Documentation (JUN 2023)

(http://www.dla.mil/LandandMaritime/Business/Selling/Counterfeit-Detection-Avoidance-Program/ ).

(4) The contractor shall immediately make documentation available to the contracting officer upon request. The contracting officer determines the acceptability and sufficiency of documentation. The contractor shall retain supply chain traceability documentation for six years after final payment under this contract for audit and other valid government purposes. If the contractor fails to retain or provide the documentation, or the contracting officer finds the documentation to be unacceptable, the contracting officer may take corrective action, including, but not limited to, cancellation of undelivered orders or rejection of delivered supplies.

C04 Unused Former Government Surplus Property (SEP 2021)

To be considered for award, the offeror must complete and submit the following representation with their offer. Additional supporting documentation to demonstrate the surplus material offered was previously owned by the Government and meets solicitation requirements must be provided within 24 hours of request by the contracting officer.

(1) The material is new, unused, and not of such age or so deteriorated as to impair its usefulness or safety.

Yes [__] No [__] The material conforms to the technical requirements cited in the solicitation (e.g., Commercial and Government Entity (CAGE) Code and part number, specification, etc.). Yes [__] No [__] The material conforms to the revision letter/number, if any is cited. Yes [__] No [__] Unknown __ If No, the revision does not affect form, fit, function, or interface. Yes__ No __ Unknown __ The material was manufactured by:

(Name): ______________________________________________________________________ (Address): ___________________________________________________________________

(2) The offeror currently possesses the material Yes __ No __ If yes, the offeror purchased the material from a Government selling agency or other source.

Yes __ No __ If yes, complete the following:

Government Selling Agency: ___________________________________________________ Contract Number: ____________________________________________________________ Contract Date: (Month, Year): __________________________________________________ Other Source: ________________________________________________________________ Address: ____________________________________________________________________ Date Acquired: (Month/Year) ___________________________________________________

(3) The material has been altered or modified. Yes __ No __ If Yes, complete the following:

Name of the company that performed the alternation or modification:

[(Address): __________________________________________________________________ Complete description of the alterations or modifications.

(4) The material has been reconditioned. Yes __ No __ If Yes, complete the following:

(i) The price offered includes the cost of reconditioning /refurbishment. Yes __ No __

(ii) Name of the company that reconditioned the material.

(iii) Description of any work done or to be done, including the components to be replaced and the applicable rebuild standard.

The material contains cure-dated components. Yes __ No __ If Yes, complete the following:

(6) The offered material is in its original package. Yes __ No __ If yes, complete the following:

Contract Number ______________________________________________________________

NSN_________________________________________________________________________

CAGE Code__________________________________________________________________ Part Number __________________________________________________________________ Other Markings/Data___________________________________________________________

(7) The offeror has supplied this same material (National Stock Number) to the Government before.

Yes __ No __ If Yes, complete the following:

Agency ______________________________________________________________________ Contract Number_______________________________________________________________

(8) The material is manufactured in accordance with a specification or drawing. Yes __ No __ If Yes, complete the following:

Specification/Drawing Number ___________________________________________________ Revision (if any) _______________________________________________________________ Date__________________________________________________________________________

(9) The material has been inspected for correct part number and for absence of corrosion or any obvious defects.

Yes __ No __ If Yes, complete the following:

The offeror agrees that in the event of award and notwithstanding the provisions of the solicitation, inspection and acceptance of the surplus material will be performed at source or destination subject to all applicable provisions for source or destination inspection.

The offeror will forward one of the following, within 24 hours of request by the contracting officer, to demonstrate that the material being offered was previously owned by the Government (offeror check which one applies):

___ For national or local sales, conducted by sealed bid, spot bid or auction methods, a solicitation/Invitation For Bid and corresponding DLA Disposition Services Form 1427, Notice of Award, Statement and Release Document.

___ For DLA Disposition Services Commercial Venture (CV) Sales, the shipment receipt/delivery pass document and invoices/receipts used by the original purchaser to resell the material.

___ When the above documents are not available, or if they do not identify the specific NSN being acquired, a copy or facsimile of all original package markings and data, including NSN, commercial and Government entity (CAGE) code and part number, and original contract number.