Combined Synopsis and Solicitation.pdf

This is a COMBINED SYNOPSIS/SOLICITATION for commercial items prepared in accordance with the information in FAR Subpart 12.6, as supplemented with the additional information included in this notice. This announcement constitutes the only solicitation; a written solicitation will not be issued. PAPER COPIES OF THIS SOLICITATION WILL NOT BE AVAILABLE. This combined synopsis/solicitation SHALL be posted the GPE at SAM.gov | Contract Opportunities.

The RFQ number is N4215826QB506. This solicitation documents and incorporates provisions and clauses in effect through Federal Acquisition Circular 2025-06 and DFARS Change Notice 11/10/2025. It is the responsibility of the contractor to be familiar with the applicable clauses and provisions. The clauses may be accessed in full text at these addresses: https://www.acquisition.gov/far/ http://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html. The NAICS code is 336611 and the Small Business Standard is 1300 employees.

The proposed contract action is for commercial supplies or services for which the Government intends to solicit and negotiate with only one source under the authority of FAR part 12.102 (a). This notice of intent is not a request for competitive proposals. However, all bids, proposals, or quotations received by the closing response date will be considered by the Government. A determination by the Government not to compete with this proposed contract based upon responses to this notice is solely within the discretion of the Government. Information received will normally be considered solely for the purpose of determining whether to conduct a competitive procurement.

The Norfolk Naval Shipyard Contracting Department requests responses from qualified sources capable of providing: 1 JOB, #2 Emergency Diesel Generator Technical Oversight on a Ford Class Carrier.

Period of performance is from July 1st, 2026 to October 31st 2026; Delivery Location FOB Destination applies.

Responsibility and Inspection: unless otherwise specified in the order, the supplier is responsible for the performance of all inspection requirements and quality control.

The following FAR provisions and clauses are applicable to this procurement:

52.212-1 Instructions to Offerors - Commercial Items 52.212-2 Evaluation – Commercial Products and Commercial Services 52.212-4 Contract Terms and Conditions - Commercial Items 52.204-7 System for Award Management 52.204-9 Personal Identity Verification of Contractor Personnel 52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards 52.204-13 SAM maintenance 52.209-6 Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations 52.219-28 Postaward Small Business Program Rerepresentation.

52.222-3 Convict Labor 52.222-36 Affirmative Action for Workers with Disabilities 52.222-41 Service Contract Labor Standards 52.222-42 Statement of Equivalent Rates for Federal Hires 52.222-50 Combating Trafficking in Persons 52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving 52.232-33 Payment by Electronic Funds Transfer-System for Award Management

52.232-39 Unenforceability of Unauthorized Obligations 52.247-29 FOB origin 52.252-1 Solicitation Provisions Incorporated by Reference 52.252-2 Clauses Incorporated by Reference.

All clauses shall be incorporated by reference in the order. Additional contract terms and conditions applicable to this procurement are:

252.203-7000 Requirements Relating To Compensation of Former DoD Officials 252.203-7002 Requirement to Inform Employees of Whistleblower Rights 252.203-7005 Representation Relating To Compensation of Former DoD Officials 252.204-7004 Antiterrorism training for contractors 252.204-7015 Disclosure of Information to Litigation Support Contractors 252.225-7048 Export-Controlled Items 252.232-7003 Electronic Submission of Payment Requests And Receiving Reports 252.232-7006 Wide Area WorkFlow Payment Instructions 252.232-7010 Levies On Contract Payments 252.237-7010 Prohibition on Interrogation of Detainees by Contractor Personnel [for services only] 252.244-7000 Subcontracts For Commercial Items 252.247-7023 Transportation of Supplies by Sea

All clauses shall be incorporated by Full Text in the order. Additional contract terms and conditions applicable to this procurement are:

252.204-7021 Compliance with the Cybersecurity Maturity Model Certification Level Requirements.

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL

CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) Definitions. As used in this clause—

“Controlled unclassified information” means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

“Current” means—

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status—

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status—

(i) Not older than 1 year for Final Level 1 (Self), with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the

Final CMMC Status date (see 32 CFR 170.15); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

“Cybersecurity Maturity Model Certification (CMMC) status” means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

“Cybersecurity Maturity Model Certification unique identifier (CMMC UID)” means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.

“Federal contract information (FCI)” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

“Plan of action and milestones” means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication 800-115 (32 CFR 170.21).

(b) Framework. The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor’s compliance with applicable information security protections (see 32 CFR part 170).

(c) Duplication. The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances when a reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) Requirements. The Contractor shall—

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: ____________ Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC) for all information systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required in paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) Reporting. The Contractor shall—

(1) Submit to the Contracting Officer—

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract; and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2) Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract;

and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) Subcontracts. The Contractor shall—

(1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items, if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.

252.204-7025 Notice of Cybersecurity Maturity Model Certification Level Requirements.

NOTICE OF CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL

REQUIREMENTS (NOV 2025)

(a) Definitions. As used in this provision, “controlled unclassified information (CUI),” “current,” “Cybersecurity Maturity Model Certification (CMMC) status,” “Cybersecurity Maturity Model Certification unique identifier (CMMC UID),” “Federal contract information (FCI)”, and “plan of action and milestones” have the meaning given in the Defense Federal Acquisition Regulation Supplement 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, clause of this solicitation.

(b)(1) Cybersecurity Maturity Model Certification (CMMC) level. The CMMC level required by this solicitation is: ____________ [Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)]. This CMMC level, or higher (see 32 CFR part 170), is required prior to award for each contractor information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the contract.

(2) The Offeror will not be eligible for award of a contract, task order, or delivery order resulting from this solicitation if the Offeror does not have, for each of the contractor information systems that will process, store, or transmit FCI or CUI and that will be used in performance of a contract resulting from this solicitation—

(i) The current CMMC status entered in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) at the CMMC level required by paragraph (b)(1) of this provision; and

(ii) A current affirmation of continuous compliance with the security requirements identified at 32 CFR part 170 in SPRS.

(c) Plan of action and milestones. If the Offeror has a CMMC Status of Conditional, the Offeror shall successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(d) CMMC unique identifiers. The Offeror shall provide, in the proposal, the CMMC unique identifier(s) (CMMC UIDs) issued by SPRS for each contractor information system that will process, store, or transmit FCI or CUI during performance of a contract, task order, or delivery order resulting from this solicitation. The Offeror also shall update the list when new CMMC UIDs are generated in SPRS. The CMMC UIDs are provided in SPRS after the Offeror enters the results of self-assessment(s) for each such information system.

The following local provisions and clauses are applicable to this procurement:

C-202-H001 Additional Definitions—Basic C-211-H018 Approval by the Government C-223-W002 On-Site Safety Requirements G-232-H002 Payment Instructions and Contract Type Summary for Payment Office

G-232-H005 Supplemental Instructions Regarding Invoicing G-242-H001 Government Contract Administration Points of Contact and Responsibilities G-242-H002 Hours of Operation and Holiday Schedule

This announcement will close at 4:00 pm on Friday March 6th. Contact Gordon Weston or Rebekah Riggins who can be reached at 757-396-0964, 757-967-4014 respectively or email Gordon.t.weston3.civ@us.navy.mil, rebekah.r.riggins.civ@us.navy.mil respectively. All responsible sources may submit a quote which shall be considered by the agency.

System for Award Management (SAM). Quoters must be registered in the SAM database to be considered for award. Registration is free and can be completed on-line at http://www.sam.gov/.

All quotes shall include price(s), FOB point, a point of contact, name and phone number, GSA contract number if applicable, business size, and payment terms. Quotes over 10 pages in total will not be accepted by facsimile.

Each response must clearly indicate the capability of the quoter to meet all specifications and requirements.