Cybersecurity_Maturity_Model_Certification__CMMC_.docx

Awards resulting from this Broad Agency Announcement (BAA) that take the form of procurement contracts are subject to the Cybersecurity Maturity Model Certification (CMMC) requirements prescribed in 32 CFR Part 170 and DFARS 252.204-7021, Cybersecurity Maturity Model Certification Requirements. The Government will designate the required CMMC level (1, 2, or 3) in each resulting contract based on the sensitivity of the information involved—Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

If the PM/SID determines CMMC Level 1 – Basic Safeguarding of FCI, then the following will apply:

CMMC Level 1

a. Applicability:

Applies when the contractor will handle Federal Contract Information (FCI) only.

b. Requirement:

Contractors shall implement the 17 basic safeguarding requirements in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, and maintain practices equivalent to CMMC Level 1.

c. Assessment:

Prior to award, the Offeror shall have a current CMMC Level 1 Self-Assessment recorded in the Supplier Performance Risk System (SPRS) in accordance with DFARS 252.204-7021.

d. CMMC Post-Assessment Remediation: Plan of Actions and Milestones (POA&M) POA&M is not permitted for CMMC Level 1.

e. Certification Status:

A valid and current Level 1 certification is a condition of award. Offerors that do not possess the required certification at the time of award shall be ineligible for contract award.

f. Flow-Down:

The Contractor shall ensure that any subcontractor processing, storing, or transmitting FCI also maintains a current Level 1 Self-Assessment in SPRS.

g. Verification:

The Contractor shall maintain its Level 1 certification for the full contract period. The Government will verify certification status in SPRS and may request access to assessment results or supporting evidence at any time.

If the PM/SID determines CMMC Level 2 – Broad Protection of CUI, then the following will apply:

CMMC Level 2

a. Applicability:

Applies when the contractor will handle Controlled Unclassified Information (CUI) on non-Federal systems.

b. Requirement:

Contractors shall implement the 110 security requirements in NIST SP 800-171 Rev. 2 and meet the standards for CMMC Level 2.

c. Assessment: (This language will change after 10 November 2026 when a C3PAO level 2 assessment is required)

1. Self-Assessment: The Offeror shall have a current CMMC Level 2 Self-Assessment posted in SPRS prior to award.

2. C3PAO Assessment: The Offeror shall hold a current CMMC Level 2 Certification issued by an authorized CMMC Third-Party Assessment Organization (C3PAO) prior to award. (add this statement 10 Nov 2026)

d. CMMC Post-Assessment Remediation: Plan of Actions and Milestones (POA&M) A POA&M closeout assessment is a CMMC assessment that evaluates only the NOT MET requirements identified in the initial assessment. The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out within this timeframe, the Conditional CMMC Status for the information system will expire

1. Level 2 Self-Assessment: The POA&M closeout self-assessment shall be performed by the OSA in the same manner as the initial self-assessment.

2. Level 2 Certification Assessment: The POA&M closeout certification assessment must be performed by an authorized or accredited C3PAO.

e. Certification Status:

A valid and current Level 2 certification is a condition of award. Offerors that do not possess the required certification at the time of award shall be ineligible for contract award.

f. Flow-Down:

The Contractor shall flow this requirement to any subcontractor whose work involves CUI.

g. Maintenance and Verification:

The Contractor shall maintain its Level 2 certification for the full contract period. The Government will verify certification status in SPRS and may request access to assessment results or supporting evidence at any time.

If the PM/SID determines CMMC Level 3 – Higher-Level Protection of CUI Against Advanced Persistent Threats, then the following will apply:

CMMC Level 3

a. Applicability:

Applies when performance involves CUI requiring protection from advanced persistent threats (APT) or when specified by the Government.

b. Requirement:

Contractors shall implement all requirements of NIST SP 800-171 plus the enhanced controls identified in NIST SP 800-172, consistent with CMMC Level 3.

c. Assessment:

Offerors must successfully complete a Government-led CMMC Level 3 Assessment prior to contract award, as defined in DFARS 252.204-7021 and current CMMC implementation guidance.

d. CMMC Post-Assessment Remediation: Plan of Actions and Milestones (POA&M) A POA&M closeout assessment is a CMMC assessment that evaluates only the NOT MET requirements identified in the initial assessment. The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out within this timeframe, the Conditional CMMC Status for the information system will expire.

1. Level 3 Certification Assessment: The POA&M closeout certification assessment will be performed by DCMA DIBCAC.

e. Certification Status:

A valid and current Level 3 certification is a condition of award. Offerors that do not possess the required certification at the time of award shall be ineligible for contract award.

f. Flow-Down:

The Contractor shall ensure that all subcontractors processing, storing, or transmitting CUI under the contract maintain a Level 3 certification or higher.

g. Maintenance and Verification:

The Contractor shall maintain its Level 3 certification for the full contract period. The Government will verify certification status in SPRS and may request access to assessment results or supporting evidence at any time.