ATTACH_Attachment_B.pdf

Attachment B

The following reflects changes to the DFARS prescription, provisions and/or clauses

252.204-7003 Control of government personnel work product.

As prescribed in 240.372-3(b), use the following clause:

CONTROL OF GOVERNMENT PERSONNEL WORK PRODUCT (APR 1992)

252.204-7008 Compliance with safeguarding covered defense information controls.

As prescribed in 240.370-5(a), use the following provision:

COMPLIANCE WITH SAFEGUARDING COVERED DEFENSE INFORMATION

CONTROLS (OCT 2016)

252.204-7016 Covered Defense Telecommunications Equipment or Services—Representation.

As prescribed in 240.270-6(a), use the following provision:

COVERED DEFENSE TELECOMMUNICATIONS EQUIPMENT OR SERVICES—

REPRESENTATION (DEC 2019)

252.204-7017 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services—Representation.

As prescribed in 240.270-6(b), use the following provision:

PROHIBITION ON THE ACQUISITION OF COVERED DEFENSE

TELECOMMUNICATIONS EQUIPMENT OR SERVICES—REPRESENTATION

(MAY 2021)

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

As prescribed in 240.270-6(c), use the following clause:

PROHIBITION ON THE ACQUISITION OF COVERED DEFENSE

TELECOMMUNICATIONS EQUIPMENT OR SERVICES (JAN 2023)

252.240-7997 NIST SP 800-171 DoD Assessment Requirements.

As prescribed in 240.370-5(e), use the following clause:

NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS

(DEVIATION 2026-O0025)(FEB 2026)

(a) Definitions.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

High Assessment means an assessment that is conducted by Government personnel, trained in accordance with DoD policy and procedures, using NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information that—

(1) Consists of—

(i) A review of a contractor's previous assessment(s), as applicable;

(ii) A thorough document review;

(iii) Verification, examination, and demonstration of a Contractor's system security plan to validate that NIST SP 800-171 security requirements have been implemented as described in the contractor's system security plan; and

(iv) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of “High” in the resulting score.

Medium Assessment means an assessment conducted by Government personnel, trained in accordance with DoD policy and procedures, using NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information that—

(1) Consists of—

(i) A review of a contractor's previous assessment(s), as applicable;

(ii) A thorough document review; and

(iii) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of “Medium” in the resulting score.

(b) Applicability. This clause applies to covered contractor information systems that are required to comply with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, in accordance with Defense Federal Acquisition Regulation System (DFARS) clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

(c) Requirements. The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, using the methodology described at 32 CFR 170.24, if necessary. The results of Medium or High NIST SP 800-171 DoD Assessments, when conducted by DCMA, will take precedence over any other assessment, in accordance with 32 CFR 170.16(a)(1)(iv), 32 CFR 170.17(a)(1)(iv), and 32 CFR 170.18(a)(1)(iv).

(d) Procedures. Summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system security plan assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, i.e., DCMA.

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) Date and level of the assessment, i.e., medium or high.

(v) Summary level score (overall numerical score, not the individual value assigned for each requirement).

(vi) Date that all requirements are expected to be implemented based on information gathered from associated plan(s) of action developed in accordance with

NIST SP 800-171.

(e) Rebuttals. (1) DoD will provide Medium and High Assessment summary level scores to the Contractor and offer the opportunity for rebuttal and adjudication of assessment summary level scores prior to posting the summary level scores to SPRS (see SPRS User's Guide https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf).

(2) Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

(f) Accessibility. (1) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information (PI).

(2) Authorized representatives of the Contractor for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(3) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this clause. DoD will retain and protect any such documentation as “Controlled Unclassified Information (CUI)” and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

(g) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services (excluding commercially available off-the-shelf items).

(End of clause)

252.215-7992 Only One Offer. (DEVIATION 2026-O0048) As prescribed at 215.110-70(c), use the following provision:

ONLY ONE OFFER (DEVIATION 2026-O0048) (MAR 2026)

(a) Cost or pricing data requirements. After initial submission of offers, if the Contracting Officer notifies the Offeror that only one offer was received, the Offeror agrees to—

(1) Submit any additional cost or pricing data that is required in order to determine whether the price is fair and reasonable (10 U.S.C. 3705) or to comply with the statutory requirement for certified cost or pricing data (10 U.S.C. 3702);

and

(2) Except as provided in paragraph (b) of this provision, if the acquisition exceeds the certified cost or pricing data threshold and an exception to the requirement for certified cost or pricing data at FAR 15.403-2(b)(2) through (5) does not apply, certify all cost or pricing data in accordance with paragraph (c) of DFARS provision 252.215-7994, Requirements for Certified Cost or Pricing Data and Data Other Than Certified Cost or Pricing Data, of this solicitation.

(b) Canadian Commercial Corporation. If the Offeror is the Canadian Commercial Corporation, certified cost or pricing data are not required. If the Contracting Officer notifies the Canadian Commercial Corporation that additional data other than certified cost or pricing data are required in accordance with DFARS 225.870-4(c), the Canadian Commercial Corporation shall obtain and provide the following:

(1) Profit rate or fee (as applicable).

(2) Analysis provided by Public Works and Government Services Canada to the Canadian Commercial Corporation to determine a fair and reasonable price (comparable to the analysis required at 15.404).

(3) Data other than certified cost or pricing data necessary to permit a determination by the U.S. Contracting Officer that the proposed price is fair and reasonable [U.S. Contracting Officer to provide description of the data required in accordance with FAR 15.403-1 with the notification].

(4) As specified in FAR 15.403-1(d), an offeror who does not comply with a requirement to submit data that the U.S. Contracting Officer has deemed necessary to determine price reasonableness or cost realism is ineligible for award unless the head of the contracting activity determines that it is in the best interest of the Government to make the award to that offeror.

(c) Subcontracts. Unless the Offeror is the Canadian Commercial Corporation, the Offeror shall insert the substance of this provision, including this paragraph (c), in all subcontracts exceeding the simplified acquisition threshold defined in FAR part 2.

(End of provision)

252.219-7996 Small Business Subcontracting Plan (DoD Contracts).

(DEVIATION 2026-O0037)

Basic. As prescribed in 219.109(e)(2)(A)(1), use the following clause:

SMALL BUSINESS SUBCONTRACTING PLAN (DOD CONTRACTS)—BASIC

(DEVIATION 2026-O0037) (FEB 2026)

This clause supplements the Federal Acquisition Regulation 52.219-9, Small Business Subcontracting Plan, clause of this contract.

(a) Definitions. As used in this clause—

“Summary Subcontract Report (SSR) Coordinator” means the individual who is registered in the Electronic Subcontracting Reporting System (eSRS) at the Department of Defense level and is responsible for acknowledging receipt or rejecting SSRs submitted under an individual subcontracting plan in eSRS for the Department of Defense.

(b) Subcontracts awarded to qualified nonprofit agencies designated by the Committee for Purchase From People Who Are Blind or Severely Disabled (41 U.S.C.

8502-8504), may be counted toward the Contractor’s small business subcontracting goal.

(c) A mentor firm, under the Pilot Mentor-Protege Program established under section 831 of Public Law 101-510, as amended, may count toward its small disadvantaged business goal, subcontracts awarded to—

(1) Protege firms which are qualified organizations employing the severely disabled; and

(2) Former protege firms that meet the criteria in section 831(g)(4) of Public Law 101-510.

(d) The master plan is approved by the Contractor's cognizant contract administration activity.

(e) In those subcontracting plans which specifically identify small businesses, the Contractor shall notify the Administrative Contracting Officer of any substitutions of firms that are not small business firms, for the small business firms specifically identified in the subcontracting plan. Notifications shall be in writing and shall occur within a reasonable period of time after award of the subcontract. Contractor-specified formats shall be acceptable.

(f)(1) For DoD, the Contractor shall submit reports in eSRS as follows:

(i) Submit the Individual Subcontract Report (ISR) to the contracting officer at the procuring contracting office, even when contract administration has been delegated to the Defense Contract Management Agency.

(ii) Submit the consolidated SSR for an individual subcontracting plan to the “Department of Defense.”

(2) For DoD, the authority to acknowledge receipt or reject reports in eSRS is as follows:

(i) The authority to acknowledge receipt or reject the ISR resides with the contracting officer who receives it, as described in paragraph (f)(1)(i) of this clause.

(ii) The authority to acknowledge receipt of or reject SSRs submitted under an individual subcontracting plan resides with the SSR Coordinator.

(g) Insert the clause at Defense Federal Acquisition Regulation Supplement (DFARS) 252.219-7997, Small Business Subcontracting Plan (Test Program), in subcontracts with subcontractors that participate in the Test Program described in DFARS 219.206-70, if the subcontract is expected to exceed the applicable threshold specified in Federal Acquisition Regulation 19.109(a)(1) and to have further subcontracting opportunities.

(End of clause)

252.244-7999 Subcontracts for Commercial Products or Commercial Services.

(DEVIATION 2026-O0015)

As prescribed in 244.470-1, use the following clause:

SUBCONTRACTS FOR COMMERCIAL PRODUCTS OR COMMERCIAL SERVICES

(FEB 2026)(DEVIATION 2026-O0015)

(a) The Contractor shall not include the terms of any Federal Acquisition Regulation (FAR) clause or Defense Federal Acquisition Regulation Supplement (DFARS) clause in subcontracts for commercial products or commercial services at any tier under this contract, unless—

(1) For DFARS clauses, it is so specified in the particular clause; or

(2) For FAR clauses, the clause is listed at FAR 12.205 or it is so specified in paragraph (b) of the clause at FAR 52.244-6, as applicable. (Section 847(b)(1)(B), Pub.

L. 114-328)

(b)(1) In accordance with 10 U.S.C. 3457(c), the Contractor shall treat as commercial products any items valued at less than $10,000 per item that were purchased by the Contractor for use in the performance of multiple contracts with the Department of Defense and other parties and are not identifiable to any particular contract when purchased.

(2) The Contractor shall ensure that any items to be used in performance of this contract, that are treated as commercial products pursuant to paragraph (b)(1) of this clause, meet all terms and conditions of this contract that are applicable to commercial products in accordance with the clause at FAR 52.244-6 and paragraph (a) of this clause.

(c) Subcontracts. The Contractor shall include the terms of this clause, including this paragraph (c), in subcontracts awarded under this contract, including subcontracts for the acquisition of commercial products or commercial services.

(End of clause)

ATTACHMENT WAS CREATED BY ROMONA SKEETE DLA TROOP SUPPORT

PHILADELPHIA