FA825026Q0590 amend 1.pdf

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 18 (Rev. 6-95) Previous edition not usable Prescribed by GSA - FAR (48 CFR) 53.215-1(a)

REQUEST FOR QUOTATION

(THIS IS NOT AN ORDER)

J

THIS RFQ IS IS NOT A SMALL BUSINESS SET-ASIDEX

1. REQUEST NO. 2. DATE ISSUED

9 APR 2026

3. REQUISITION/PURCHASE REQUEST NO.

FD20202600590

4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG.1

RATING

DO: A7

5a. ISSUED BY CODE: FA8250

DEPARTMENT OF THE AIR FORCE, DIRECTORATE OF CONTRACTING

AFSC PZAAA1

6050 GUM LANE BLDG 1215

HILL AIR FORCE BASE UT 84056-5825

BUYER: Valerie J. Humphries/AFSC valerie.humphries@us.af.mil Phone: (801) 775- 6455

6. DELIVERY BY (Date)

SEE SCHEDULE

SCD:B

5b. FOR INFORMATION CALL (NO COLLECT CALLS)

NAME

Valerie J Humphries

b. COMPANY

TELEPHONE NUMBER

AREA CODE

(801 )

NUMBER

775 -6455

8. TO

a. NAME

7. DELIVERY

FOB DESTINATION OTHER

(See Schedule)

9. DESTINATION

a. NAME OF CONSIGNEE

b. STREET ADDRESS

c. CITY

d. STATE e. ZIP CODE

c. STREET ADDRESS

d. CITY e. STATE f. ZIP CODE

10. PLEASE FURNISH QUOTATIONS

TO THE ISSUING OFFICE IN BLOCK

5A ON OR BEFORE CLOSE OF

BUSINESS (Date)

19 MAY 2026

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it to the address in Block 5A. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services. Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

d. CITY e. STATE

c. COUNTY

c. TITLE (Type or print) NUMBER

b. STREET ADDRESS

a. NAME OF QUOTER

CAGE:

13. NAME AND ADDRESS OF QUOTER

NOTE: Additional provisions and representations are are not attached.X

14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

15. DATE OF QUOTATION

16. SIGNER

a. NAME (Type or print) b. TELEPHONE

AREA CODE

d. CALENDAR DAYS

NUMBER PERCENTAGE

c. 30 CALENDAR DAYS (%)b. 20 CALENDAR DAYS (%)a. 10 CALENDAR DAYS (%)12. DISCOUNT FOR PROMPT

PAYMENT

SEE SCHEDULE

ROUTINE

Subject to the terms and conditions stated herein, the Contractor agrees to hold its offered prices firm for 120 days.

NAICS CODE: 811210

SIZE STD: $34.00

The Requirement is not an inherently government function. Repair effort is deemed performance based. Critical Safety Item (CSI) does not apply to this PI.

Requirement restricted to qualified source(s). All nonqualified vendors that submit a proposal in support of this requirement must comply with qualification requirements found in clause 52.2091, and the source qualification statement attached hereto, in order to be considered for award.

Award shall not be delayed to qualify new sources.

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 18 (Rev. 6-95) Previous edition not usable Prescribed by GSA - FAR (48 CFR) 53.215-1(a)

FOLD FOLD

SOLICITATION NO. FA825026Q0590

DUE: 19 -MAY -2026

FROM: AFFIX

STAMP

HERE

TO:

ATTN: Valerie J Humphries/AFSC

DEPARTMENT OF THE AIR FORCE, DIRECTORATE OF CONTRACTING

AFSC PZAAA1

6050 GUM LANE BLDG 1215

HILL AIR FORCE BASE UT 84056-5825

SUPPLIES OR SERVICES AND PRICES/COSTS

In accordance with the attached CAV AF Reporting Requirements (see the document listed in Section J), the Contractor shall include a DD1348-1 when assets are shipped. DCMA Quality Assurance Representatives (QARs) will not approve or sign the DD1348-1, but will ensure a DD1348-1 is included with each returned asset. If a DD1348-1 is not included with each returned asset, DCMA will not sign the receiving report (DD250).

AMENDMENT: Closes 19 MAY 2026. Adding prescribing language for 252.2047021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements and

252.2047025 Notice of Cybersecurity Maturity Model Certification Level Requirements.

ACO AUTHORITY AND RESPONSIBILITIES:

1) All applicable contract admin functions as outlined in FAR 42.302(a) and DFARS 242.302(a)

2) Extend the delivery schedule as required and take consideration if deemed necessary.

3) Initiate close out when actions required in paragraph 4) are completed.

4) ACO is to verify Commercial Asset Visibility Air Force (CAVAF) inputs have been made before authorizing payment on the contract. Inputs can be verified by emailing 415SCMS.PMS.Contract@us.af.mil

5) ACO is authorized to take consideration from the contractor for failure to comply with CAVAF inputs.

In the case of a Beyond Economical Repair (BER) determination, DCMA QAR shall request disposition instructions and/or condemnation approvals from the cognizant USAF Program Manager or customer, and supply disposition/condemnation instructions to the contractor.

Test, Teardown, and Evaluation (TT&E)

NSN: 5998013266349 VE

Item No.

Firm Fixed Price Quantity U/I Unit Price Amount

1 EA

CLIN ACRN ACRN Total

0001 AA

NSN: 5998013266349 VE

CIRCUIT CARD ASSEMB

translates satellite date Wafer board, circuits, solder, elecronics Manufacturer Part Number

0HJG7 10010112

3DG95 002120170

52GG4 002120170

61362 002120170 61362 00212017001 61362 01212016201 Associated Document(s) Line Item(s)

FD20202600590 0001

Priority: R

Inspection: Origin Acceptance: Origin Quality Assurance: Standard Inspection

Test, Teardown, and Evaluation (TT&E)

NSN: 5998013266349 VE

IUID Required: Yes Physical Item Markings:

Latest Cost Amount: $11,922.30

Transportation From Continental United States CONUS (CONUS) Sources

TYPE / SHIP TO CODE F.O.B.

+ CNOTE ORIGIN

Type / Ship To PACRN Mark For

+ CNOTE PAE

Type / Ship To Quantity (U/I) *ARO After Receipt of

Carcass Req No / Pri

Required Delivery

+ CNOTE 1 EA *30 Days

Proposed Delivery

+ CNOTE 1 EA

AT PLANT

REPAIR

NSN: 5998013266349 VE

Item No.

Firm Fixed Price Quantity U/I Unit Price Amount

1 EA

CLIN ACRN ACRN Total

0002 AA

NSN: 5998013266349 VE

CIRCUIT CARD ASSEMB

Manufacturer Part Number

0HJG7 10010112

61362 002120170 61362 00212017001 61362 01212016201 Associated Document(s) Line Item(s)

FD20202600590 0002

Priority: R

Limitations of Liability: Other Than High Value Item

Inspection: Origin Acceptance: Origin Inspection/Acceptance Report: Receiving Report Required Quality Assurance: Standard Inspection Latest Cost Amount: $11,922.30

REPAIR

NSN: 5998013266349 VE

Transportation From Continental United States CONUS (CONUS) Sources

TYPE / SHIP TO CODE F.O.B.

A SW3215 ORIGIN

Type / Ship To PACRN Mark For

A SW3215 PAE ACCOUNT A

Type / Ship To Quantity (U/I) *ARO After Completion of Study Req No / Pri

Required Delivery

A SW3215 1 EA *120 Days

Proposed Delivery

A SW3215 1 EA

Commercial Asset Visibility Air Force (CAVAF)

Data Item No. A001, A002, A003 Item No.

Not Separately Priced Quantity U/I Unit Price

1 EA NSP

Data IAW DD Form 1423 Data Item No. A001, A002, A003 CAV Associated Document(s) Line Item(s)

FD20202600590 0003

Priority: R

Limitations of Liability: Other Than High Value Item

Inspection: Destination Acceptance: Destination Inspection/Acceptance Report: LETTER OF TRANSMITTAL Quality Assurance: Standard Inspection

Transportation From Continental United States CONUS (CONUS) Sources

TYPE / SHIP TO CODE F.O.B.

A FB2029 ORIGIN

Type / Ship To Quantity (U/I) IAW DD Form 1423

Data Item No. A001, A002, A003 CAV

Req No / Pri

Required Delivery

A FB2029 1 EA IAW DD Form 1423 Data Ite

Proposed Delivery

A FB2029 1 EA

DCMA shall coordinate with CAVAF monitor to ensure requirements are met prior to Repair Invoice Acceptance. If CAVAF requirements are not met in accordance with the CDRL then payment may be withheld until CAVAF requirements are met. DCMA shall not provide acceptance until receipt of concurrence from CAVAF monitor.

IAW DD Form 1423 Data Item No. A001, A002, A003 CAV

Repairable Item Inspection Report (RIIR)

Data Item No. B001Data Item No. B001 Item No.

Not Separately Priced Quantity U/I Unit Price

2 EA NSP

Data IAW DD Form 1423 Data Item No. B001 RIIR Associated Document(s) Line Item(s)

FD20202600590 0004

Priority: R

Limitations of Liability: Other Than High Value Item

Inspection: Destination Acceptance: Destination Inspection/Acceptance Report: Receiving Report Required Quality Assurance: Standard Inspection

Transportation From Continental United States CONUS (CONUS) Sources

TYPE / SHIP TO CODE F.O.B.

A FY2073 ORIGIN

Type / Ship To Quantity (U/I) IAW DD Form 1423

Data Item No. B001

RIIR

Req No / Pri

Required Delivery

A FY2073 2 EA IAW DD Form 1423 Data Ite

Proposed Delivery

A FY2073 2 EA

The prices of notseparatelypriced DATA are included in the price of the individual Repair.

Failure to comply with contract data requirements may result in the withholding of payment on the aforementioned CLINs. This allows the government to withhold payment on the repairs if the contractor does not deliver the required data. The data is a material requirement of the contract.

IAW DD Form 1423 Data Item No. B001 RIIR

Counterfeit Prevention Plan (CPP)

Data Item No. C001 Item No.

Counterfeit Prevention Plan (CPP)

Data Item No. C001 Not Separately Priced Quantity U/I Unit Price

2 EA NSP

Data IAW DD Form 1423 Data Item No. C001 CPP Associated Document(s) Line Item(s)

FD20202600590 0005

Priority: R

Limitations of Liability: Other Than High Value Item

Inspection: Destination Acceptance: Destination Inspection/Acceptance Report: Receiving Report Required Quality Assurance: Standard Inspection

Transportation From Continental United States CONUS (CONUS) Sources

TYPE / SHIP TO CODE F.O.B.

A FY2073 ORIGIN

Type / Ship To Quantity (U/I) IAW DD Form 1423

Data Item No. C001

CPP

Req No / Pri

Required Delivery

A FY2073 2 EA IAW DD Form 1423 Data Ite

Proposed Delivery

A FY2073 2 EA

IAW DD Form 1423 Data Item No. C001 CPP

Engineering Change Proposal (ECP)

Data Item No. D001 Item No.

Firm Fixed Price Quantity U/I Unit Price Amount

3 EA

Data IAW DD Form 1423 Data Item No.D001 ECP Associated Document(s) Line Item(s)

FD20202600590 0006

Priority: R

Limitations of Liability: Other Than High Value Item

Inspection: Destination Acceptance: Destination Inspection/Acceptance Report: Receiving Report Required

Engineering Change Proposal (ECP)

Data Item No. D001 Quality Assurance: Standard Inspection

Transportation From Continental United States CONUS (CONUS) Sources

TYPE / SHIP TO CODE F.O.B.

A FY2073 ORIGIN

Type / Ship To Quantity (U/I) IAW DD Form 1423

Data Item No.D001 ECP Req No / Pri

Required Delivery

A FY2073 3 EA IAW DD Form 1423 Data Ite

Proposed Delivery

A FY2073 3 EA

IAW DD Form 1423 Data Item No.D001 ECP

SHIP TO / PLACE OF PERFORMANCE

TYPE/CODE: + CNOTE

MARK FOR: (See Individual Line Item) REQUISITION NUMBER: (See Individual Line Item) REQUISITION PRIORITY: (See Individual Line Item)

AWARD NUMBER:

TYPE/CODE: A FB2029

FB2029 OO ALC DDHU CNTRL RCV

CENTRAL RECEIVING BLDG 849W

CP 385 519 8898

5851 F AVE BLDG 849W

HILL AFB UT 84056 UT 840564056

USA

MARK FOR: (See Individual Line Item) REQUISITION NUMBER: (See Individual Line Item) REQUISITION PRIORITY: (See Individual Line Item)

AWARD NUMBER:

TYPE/CODE: A FY2073

FY2073 GLSC 415 SCMS

CP 801 586 1368

6041 GUM LANE BLDG 1226

HILL AFB UT 840565820

HILL AFB UT 840565820 UT 840564056

USA

MARK FOR: (See Individual Line Item) REQUISITION NUMBER: (See Individual Line Item) REQUISITION PRIORITY: (See Individual Line Item)

AWARD NUMBER:

TYPE/CODE: A SW3215

DLA DISTRIBUTION BARSTOW

CENTRAL RECEIVING WHSE 7

REC OFFICER 4422954148

BARSTOW CA 923115014

BARSTOW CA 923115014 06 923115014

USA

MARK FOR: (See Individual Line Item) REQUISITION NUMBER: (See Individual Line Item) REQUISITION PRIORITY: (See Individual Line Item)

AWARD NUMBER:

AT PLANT

CONTRACT CLAUSES

TAI ATAC FMS ALLOTMENT/Note

TAA

TAA ACRN AA F3RS

52.24090 Security Prohibitions and Exclusions Representations and Certifications.

As prescribed in 40.205(a), insert the following provision:

Security Prohibitions and Exclusions Representations and Certifications (Deviation Date)

(a) Definitions. As used in this provision—

Backhaul, covered article, covered telecommunications equipment or services, critical technology, FASCSA order, Intelligence community, interconnection arrangements, national security system, roaming, sensitive compartmented information, sensitive compartmented information system, source, and substantial or essential component have the meanings provided in the clause 52.24091, Security Prohibitions and Exclusions.

Business operations means engaging in commerce in any form, including by acquiring, developing, maintaining, owning, selling, possessing, leasing, or operating equipment, facilities, personnel, products, services, personal property, real property, or any other apparatus of business or commerce.

Marginalized populations of Sudan means—

(1) Adversely affected groups in regions authorized to receive assistance under section 8(c) of the Darfur Peace and Accountability Act (Pub. L. 109344) (50 U.S.C. 1701 note); and

(2) Marginalized areas in Northern Sudan described in section 4(9) of such Act.

Restricted business operations means business operations in Sudan that include power production activities, mineral extraction activities, oilrelated activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (Pub. L. 110174). Restricted business operations do not include business operations that the person (as that term is defined in Section 2 of the Sudan Accountability and Divestment Act of 2007) conducting the business can demonstrate—

(1) Are conducted under contract directly and exclusively with the regional government of southern Sudan;

(2) Are conducted under specific authorization from the Office of Foreign Assets Control in the Department of the Treasury, or are expressly exempted under Federal law from the requirement to be conducted under such authorization;

(3) Consist of providing goods or services to marginalized populations of Sudan;

(4) Consist of providing goods or services to an internationally recognized peacekeeping force or humanitarian organization;

(5) Consist of providing goods or services that are used only to promote health or education; or

(6) Have been voluntarily suspended.

Sensitive technology—

(1) Means hardware, software, telecommunications equipment, or any other technology that is to be used specifically—

(i) To restrict the free flow of unbiased information in Iran; or

(ii) To disrupt, monitor, or otherwise restrict speech of the people of Iran; and

(2) Does not include information or informational materials the export of which the President does not have the authority to regulate or prohibit pursuant to section 203(b)(3) of the International Emergency Economic Powers Act (50 U.S.C. 1702(b)(3)).

(b) Procedures.

(1) Covered telecommunications and video surveillance. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities excluded from receiving federal awards for “covered telecommunications equipment or services.”

(2) FASCSA Orders.

(i) The Offeror shall search in SAM for the phrase “FASCSA order” for any covered article, or any products or services produced or provided by a source, if there is an applicable FASCSA order described in paragraph (e) of FAR 52.24091, Security Prohibitions and Exclusions.

(ii) The Offeror shall review the solicitation for any FASCSA orders that are not in SAM but are effective and apply to the solicitation and resultant contract (see FAR 40.2041(c)(2)).

(iii) FASCSA orders issued after the date of solicitation do not apply unless added by an amendment to the solicitation.

(c) Covered telecommunications equipment or services representations. By submission of its offer, the Offeror represents that, after conducting a reasonable inquiry (that looks at any information in the Offeror’s possession but does not need to include an internal or thirdparty audit)—

(1) It will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation, except as waived by the solicitation, or as disclosed in paragraph (g); and

(2) It does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services, except as waived by the solicitation, or as disclosed in paragraph (g).

(d) FASCSA Representation. By submission of this offer, the offeror represents that it has conducted a reasonable inquiry, and that the offeror does not propose to provide or use in response to this solicitation any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by an applicable FASCSA order in effect on the date the solicitation was issued, except as waived by the solicitation, or as disclosed in paragraph (g). A reasonable inquiry will look at any information in the offeror’s possession but does not need to include an internal or thirdparty audit.

(e) Sudan certification. By submission of its offer, the offeror certifies, after conducting a reasonable inquiry (that looks at any information in the offeror’s possession but does not need to include an internal or thirdparty audit), that the offeror does not conduct any restricted business operations in Sudan.

(f) Iran Representation and Certifications.

(1) Except as provided in paragraph (f)(2) of this provision or if a waiver has been granted in accordance with FAR 40.2033, the offeror, after conducting a reasonable inquiry (that looks at any information in the offeror’s possession but does not need to include an internal or thirdparty audit), by submission of its offer—

(i) Represents, to the best of its knowledge and belief, that the offeror does not export any sensitive technology to the government of Iran or any entities or individuals owned or controlled by, or acting on behalf or at the direction of, the government of Iran;

(ii) Certifies that the offeror, or any person (as defined at section 15 of the Iran Sanctions Act of 1996, Pub. L. 104172, 50 U.S.C. 1701 note) owned or controlled by the offeror, does not engage in any activities for which sanctions may be imposed under section 5 of the Act. These sanctioned activities are in the areas of development of the petroleum resources of Iran, production of refined petroleum products in Iran, sale and provision of refined petroleum products to Iran, and contributing to Iran’s ability to acquire or develop certain weapons or technologies; and

(iii) Certifies that the offeror, and any person owned or controlled by the offeror, does not knowingly engage in any transaction that exceeds $15,000 with Iran’s Revolutionary Guard Corps or any of its officials, agents, or affiliates, the property and interests in property of which are blocked pursuant to the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) (see OFAC’s Specially Designated Nationals and Blocked Persons List at https://www.treasury.gov/resourcecenter/sanctions/SDNList/Pages/default.aspx)

(2) Exception for trade agreements. The representation and certification requirements of paragraph (f)(1) of this provision do not apply if—

(i) This solicitation includes a trade agreements notice or certification (e.g., 52.2256, Trade Agreements Certificate); and

(ii) The offeror has certified that all the offered products to be supplied are designated country end products or designated country construction material.

(iii) The offeror shall email questions concerning sensitive technology to the Department of State at CISADA106@state.gov.

(g) Disclosure.

(1) If the Offeror is not able to represent compliance with the prohibitions in paragraphs (c) or (d), then the Offeror shall disclose within 72 hours to the contracting office identified in paragraph (g)(2) the following information for each product or service not compliant:

(i) Contract number and order number, if applicable;

(ii) Identification of whether this disclosure relates to paragraph (c) on covered telecommunication equipment or services, or to paragraph (d) on FASCSA orders;

(iii) A description of the products or services that the Contractor identifies or has reason to suspect is prohibited (include brand; model number, such as the original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable);

(iv) The entity that produced the product or service (include entity name, unique entity identifier, Contractor and Government Entity (CAGE) code, facilities responsible for design, fabrication, assembly, packaging, and test of the product, and whether the entity was the OEM or a distributor (provide manufacturer codes and distributor codes used for the product));

(v) Description of the functionality of the product or service and how that functionality impacts the risk to the product or service;

(vi) An explanation of any factors relevant to determining if the product or service should be permitted by an applicable exception, exemption, or waiver (if the offeror would like the Government to consider a waiver);

(vii) Whether alternative products or services are available that would be compliant with the prohibition;

(viii) If the product or service is related to item maintenance, include the following information on the item being maintained:

(A) Brand;

(B) Model number, OEM number, manufacturer part number, or wholesaler number; and

(C) Item description, as applicable.

(ix) Any readily available information about mitigation actions undertaken or recommended.

(2) If a disclosure is required to be submitted to a contracting office, the offeror shall submit the disclosure as follows:

(i) If a Department of Defense contracting office, the offeror shall submit the disclosure to the website at https://dibnet.dod.mil.

(ii) For all other contracting offices, the Offeror shall submit the disclosure to the Contracting Officer.

(3) If the disclosure provided does not contain any of the information required by paragraph (1), and the Offeror later discovers new information that is required by paragraph (1), then the Offeror shall submit a subsequent disclosure within 72 hours of discovering the new information.

(h) Executive agency review of disclosures. The Contracting Officer will review disclosures provided in paragraph (g) to determine if any applicable waiver may be sought. The Contracting Officer may choose not to pursue a waiver and may instead make an award to an Offeror that does not require a waiver.

(End of provision)

252.2047021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements.

As prescribed in 240.3715(a), use the following clause:

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL

REQUIREMENTS (NOV 2025)

(a) Definitions. As used in this clause—

“Controlled unclassified information” means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

“Current” means—

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status—

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified thirdparty assessment organization (C3PAO)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status—

(i) Not older than 1 year for Final Level 1 (Self), with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

“Cybersecurity Maturity Model Certification (CMMC) status” means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

“Cybersecurity Maturity Model Certification unique identifier (CMMC UID)” means 10 alphanumeric characters assigned to each CMMC assessment and reflected in theSupplier Performance Risk System (SPRS) for each contractor information system.

“Federal contract information (FCI)” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

“Plan of action and milestones” means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication 800115 (32 CFR 170.21).

(b) Framework. The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor’s compliance with applicable information security protections (see 32 CFR part 170).

(c) Duplication. The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances when a reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) Requirements. The Contractor shall—

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: _Level 2 (Self)_ [Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC) ] for all information systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flow down of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required in paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) Reporting. The Contractor shall—

(1) Submit to the Contracting Officer—

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract; and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2)Enter into SPRS the results of a current selfassessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each selfassessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) Subcontracts. The Contractor shall—

(1) Insert the substance of this clause, including this paragraph ( f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products and commercial services, excluding commercially available offtheshelf items , if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.

(End of clause)

252.2047025 Notice of Cybersecurity Maturity Model Certification Level Requirements.

As prescribed in 240.3715(b), use the following provision:

NOTICE OF CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV

2025)

(a) Definitions. As used in this provision, “controlled unclassified information (CUI),” “current,” “Cybersecurity Maturity Model Certification (CMMC) status,” “Cybersecurity Maturity Model Certification unique identifier (CMMC UID),” “Federal contract information (FCI)”, and “plan of action and milestones” have the meaning given in the Defense Federal Acquisition Regulation

Supplement 252.2047021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, clause of this solicitation.

(b)(1) Cybersecurity Maturity Model Certification (CMMC) level. The CMMC level required by this solicitation is: __Level 2 (Self)__ Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC). This CMMC level, or higher (see 32 CFR part 170), is required prior to award for each contractor information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the contract.

(2) The Offeror will not be eligible for award of a contract, task order, or delivery order resulting from this solicitation if the Offeror does not have, for each of the contractor information systems that will process, store, or transmit FCI or CUI and that will be used in performance of a contract resulting from this solicitation—

(i) The current CMMC status entered in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) at the CMMC level required by paragraph (b)(1) of this provision; and

(ii) A current affirmation of continuous compliance with the security requirements identified at 32 CFR part 170 in SPRS.

(c) Plan of action and milestones. If the Offeror has a CMMC Status of Conditional, the Offeror shall successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(d) CMMC unique identifiers. The Offeror shall provide, in the proposal, the CMMC unique identifier(s) (CMMC UIDs) issued by SPRS for each contractor information system that will process, store, or transmit FCI or CUI during performance of a contract, task order, or delivery order resulting from this solicitation. The Offeror also shall update the list when new CMMC UIDs are generated in SPRS. The CMMC UIDs are provided in SPRS after the Offeror enters the results of selfassessment(s) for each such information system.

(End of provision)

52.22250 COMBATING TRAFFICKING IN PERSONS (OCT 2025)

(IAW FAR 22.1705(a)(1))

252.227-7013 RIGHTS IN TECHNICAL DATA--OTHER THAN COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (AUG 2025)

(IAW DFARS 227.7102-4(b), DFARS 227.7103-6(a))

(a) Definitions. As used in this clause— “Computer data base” means a collection of data recorded in a form capable of being processed by a computer. The term does not include computer software.

“Computer program” means a set of instructions, rules, or routines recorded in a form that is capable of causing a computer to perform a specific operation or series of operations.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Computer software documentation” means owner's manuals, user's manuals, installation instructions, operating instructions, and other similar items, regardless of storage medium, that explain the capabilities of the computer software or provide instructions for using the software.

“Covered Government support contractor" means a contractor (other than a litigation support contractor covered by 252.2047014) under a contract, the primary purpose of which is to furnish independent and impartial advice or technical assistance directly to the Government in support of the Government’s management and oversight of a program or effort, rather than to directly furnish an end item or service to accomplish a program or effort, provided that the contractor—

(1) Is not affiliated with the prime contractor or a firsttier subcontractor on the program or effort, or with any direct competitor of such prime contractor or any such firsttier subcontractor in furnishing end items or services of the type developed or produced on the program or effort; and

(2) Receives access to technical data or computer software for performance of a Government contract that contains the clause at 252.2277025, Limitations on the Use or Disclosure of GovernmentFurnished Information Marked with Restrictive Legends.

“Detailed manufacturing or process data” means technical data that describe the steps, sequences, and conditions of manufacturing, processing or assembly used by the manufacturer to produce an item or component or to perform a process.

“Developed” means that an item, component, or process exists and is workable. Thus, the item or component must have been constructed or the process practiced. Workability is generally established when the item, component, or process has been analyzed or tested sufficiently to demonstrate to reasonable people skilled in the applicable art that there is a high probability that it will operate as intended. Whether, how much, and what type of analysis or testing is required to establish workability depends on the nature of the item, component, or process, and the state of the art. To be considered “developed,” the item, component, or process need not be at the stage where it could be offered for sale or sold on the commercial market, nor must the item, component, or process be actually reduced to practice within the meaning of Title 35 of the United States Code.

“Developed exclusively at private expense” means development was accomplished entirely with costs charged to indirect cost pools, costs not allocated to a Government contract, or any combination thereof.

(1) Private expense determinations should be made at the lowest practicable level.

(2) Under fixedprice contracts, when total costs are greater than the firm fixedprice or ceiling price of the contract, the additional development costs necessary to complete development shall not be considered when determining whether development was at Government, private, or mixed expense.

“Developed exclusively with Government funds” means development was not accomplished exclusively or partially at private expense.

“Developed with mixed funding” means development was accomplished partially with costs charged to indirect cost pools and/or costs not allocated to a government contract, and partially with costs charged directly to a government contract.

“Form, fit, and function data” means technical data that describe the required overall physical, functional, and performance characteristics (along with the qualification requirements, if applicable) of an item, component, or process to the extent necessary to permit identification of physically and functionally interchangeable items.

“Generated” means, with regard to technical data or computer software, first created in the performance of this contract.

“Government purpose” means any activity in which the United States Government is a party, including cooperative agreements with international or multinational defense organizations, or sales or transfers by the United States Government to foreign governments or international organizations. Government purposes include competitive procurement, but do not include the rights to use, modify, reproduce, release, perform, display, or disclose technical data for commercial purposes or authorize others to do so.

“Government purpose rights” means the rights to—

(1) Use, modify, reproduce, release, perform, display, or disclose technical data within the Government without restriction; and

(2) Release or disclose technical data outside the Government and authorize persons to whom release or disclosure has been made to use, modify, reproduce, release, perform, display, or disclose that data for United States Government purposes.

“Limited rights” means the rights to use, modify, reproduce, release, perform, display, or disclose technical data, in whole or in part, within the Government. The Government may not, without the written permission of the party asserting limited rights, release or disclose the technical data outside the Government, use the technical data for manufacture, or authorize the technical data to be used by another party, except that the Government may reproduce, release, or disclose such data or authorize the use or reproduction of the data by persons outside the Government if—

(1) The reproduction, release, disclosure, or use is—

(i) Necessary for emergency repair and overhaul; or

(ii) A release or disclosure to—

(A) A covered Government support contractor in performance of its covered Government support contract for use, modification, reproduction, performance, display, or release or disclosure to a person authorized to receive limited rights technical data; or

(B) A foreign government, of technical data other than detailed manufacturing or process data, when use of such data by the foreign government is in the interest of the Government and is required for evaluational or informational purposes;

(2) The recipient of the technical data is subject to a prohibition on the further reproduction, release, disclosure, or use of the technical data; and

(3) The contractor or subcontractor asserting the restriction is notified of such reproduction, release, disclosure, or use.

“Small Business Innovation Research/Small Business Technology Transfer (SBIR/STTR) data” means all technical data or computer software developed or generated in the performance of a phase I, II, or III SBIR/STTR contract or subcontract.

“Technical data” means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or financial, administrative, cost or pricing, or management information, or information incidental to contract administration.

“Unlimited rights” means rights to use, modify, reproduce, perform, display, release, or disclose technical data in whole or in part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so.

(b) Applicability.

(1) Except as provided in paragraph (b)(2) of this clause—

(i) This clause governs all technical data pertaining to other than commercial products or commercial services or to any portion of a commercial product or commercial service that was developed in any part at Government expense; and

(ii) The clause at Defense Federal Acquisition Regulation Supplement (DFARS) 252.2277015, Technical Data—Commercial Products and Commercial Services, governs the technical data pertaining to any portion of a commercial product or commercial service that was developed exclusively at private expense.

(2) The clause at DFARS 252.2277018, Rights in Other Than Commercial Technical Data and Computer Software—Small Business Innovation Research Program and Small Business Technology Transfer Program, governs technical data that are SBIR/STTR data.

(c) Rights in technical data. The Contractor grants or shall obtain for the Government the following royalty free, worldwide, nonexclusive, irrevocable license rights in technical data other than computer software documentation (see the DFARS 252.2277014, Rights in Other Than Commercial Computer Software and Other Than Commercial Computer Software Documentation, clause of this contract for rights in computer software documentation):

(1) Unlimited rights. The Government shall have unlimited rights in technical data that are—

(i) Data pertaining to an item, component, or process which has been or will be developed exclusively with Government funds;

(ii) Studies, analyses, test data, or similar data produced for this contract, when the study, analysis, test, or similar work was specified as an element of performance;

(iii) Created exclusively with Government funds in the performance of a contract that does not require the development, manufacture, construction, or production of items, components, or processes;

(iv) Form, fit, and function data;

(v) Necessary for installation, operation, maintenance, or training purposes (other than detailed manufacturing or process data);

(vi) Corrections or changes to technical data furnished to the Contractor by the Government;

(vii) Otherwise publicly available or have been released or disclosed by the Contractor or subcontractor without restrictions on further use, release or disclosure, other than a release or disclosure resulting from the sale, transfer, or other assignment of interest in the technical data to another party or the sale or transfer of some or all of a business entity or its assets to another party;

(viii) Data in which the Government has obtained unlimited rights under another Government contract or as a result of negotiations; or

(ix) Data furnished to the Government, under this or any other Government contract or subcontract thereunder, with—

(A) Government purpose license rights or limited rights and the restrictive condition(s) has/have expired; or

(B) Government purpose rights and the Contractor's exclusive right to use such data for commercial purposes has expired.

(2) Government purpose rights.

(i) The Government shall have government purpose rights for a 5year period, or such other period as may be negotiated, in technical data—

(A) That pertain to items, components, or processes developed with mixed funding except when the Government is entitled to unlimited rights in such data as provided in paragraphs (c)(1)(ii) and (c)(1)(iv) through (c)(1)(ix) of this clause; or

(B) Created with mixed funding in the performance of a contract that does not require the development, manufacture, construction, or production of items, components, or processes.

(ii) The 5year period, or such other period as may have been negotiated, shall commence upon execution of the contract, subcontract, letter contract (or similar contractual instrument), contract modification, or option exercise that required development of the items, components, or processes or creation of the data described in paragraph (c)(2)(i)(B) of this clause. Upon expiration of the 5year or other negotiated period, the Government shall have unlimited rights in the technical data.

(iii) The Government shall not release or disclose technical data in which it has government purpose rights unless—

(A) Prior to release or disclosure, the intended recipient is subject to the nondisclosure agreement at DFARS 227.71037; or

(B) The recipient is a Government contractor receiving access to the data for performance of a Government contract that contains the clause at DFARS 252.2277025, Limitations on the Use or Disclosure of GovernmentFurnished Information Marked with Restrictive Legends.

(iv) The Contractor has the exclusive right, including the right to license others, to use technical data in which the Government has obtained government purpose rights under this contract for any commercial purpose during the time period specified in the government purpose rights legend prescribed in paragraph (g)(3) of this clause.

(3) Limited rights.

(i) Except as provided in paragraphs (c)(1)(ii) and (c)(1)(iv) through (c)(1)(ix) of this clause, the Government shall have limited rights in technical data—

(A) Pertaining to items, components, or processes developed exclusively at private expense and marked with the limited rights legend prescribed in paragraph (g) of this clause; or

(B) Created exclusively at private expense in the performance of a contract that does not require the development, manufacture, construction, or production of items, components, or processes.

(ii) The Government shall require a recipient of limited rights data for emergency repair or overhaul to destroy the data and all copies in its possession promptly following completion of the emergency repair/overhaul and to notify the Contractor that the data have been destroyed.

(iii) The Contractor, its subcontractors, and suppliers are not required to provide the Government additional rights to use, modify, reproduce, release, perform, display, or disclose technical data furnished to the Government with limited rights. However, if the Government desires to obtain additional rights in technical data in which it has limited rights, the Contractor agrees to promptly enter into negotiations with the Contracting Officer to determine whether there are acceptable terms for transferring such rights. All technical data in which the Contractor has granted the Government additional rights shall be listed or described in a license agreement made part of the contract. The license shall enumerate the additional rights granted the Government in such data.

(iv) The Contractor acknowledges that—

(A) Limited rights data are authorized to be released or disclosed to covered Government support contractors;

(B) The Contractor will be notified of such release or disclosure;

(C) The Contractor (or the party asserting restrictions as identified in the limited rights legend) may require each such covered Government support contractor to enter into a nondisclosure agreement directly with the Contractor (or the party asserting restrictions) regarding the covered Government support contractor’s use of such data, or alternatively, that the Contractor (or party asserting restrictions) may waive in writing the requirement for a nondisclosure agreement; and

(D) Any such nondisclosure agreement shall address the restrictions on the covered Government support contractor's use of the limited rights data as set forth in the clause at DFARS 252.2277025, Limitations on the Use or Disclosure of GovernmentFurnished Information Marked with Restrictive Legends. The nondisclosure agreement shall not include any additional terms and conditions unless mutually agreed to by the parties to the nondisclosure agreement.

(4) Specifically negotiated license rights. The standard license rights granted to the Government under paragraphs (c)(1) through (c)(3) of this clause, including the period during which the Government shall have government purpose rights in technical data, may be modified by mutual agreement to provide such rights as the parties consider appropriate but shall not provide the Government lesser rights than are enumerated in the definition of “limited rights” of this clause. Any rights so negotiated shall be identified in a license agreement made part of this contract.

(5) Prior government rights. Technical data that will be delivered, furnished, or otherwise provided to the Government under this contract, in which the Government has previously obtained rights shall be delivered, furnished, or provided with the preexisting rights, unless—

(i) The parties have agreed otherwise; or

(ii) Any restrictions on the Government's rights to use, modify, reproduce, release, perform, display, or disclose the data have expired or no longer apply.

(6) Release from liability. The Contractor agrees to release the Government from liability for any release or disclosure of technical data made in accordance with the definition of “limited rights” or paragraph (c)(2)(iii) of…