FA8523-26-Q-B003-0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

J

2. AMENDMENT/MODIFICATION NUMBER

3. EFFECTIVE DATE

23 Sep 2026

4. REQUISITION/PURCHASE

REQUISITION NUMBER

5. PROJECT NUMBER (if applicable)

6. ISSUED BY CODE FA8523

FA8523 AFLCMC WNKD

CP 478-926-6962, 236 MILLEDGEVILLE ST STE F30

ROBINS AFB, GA 31098-1663

UNITED STATES

DANIEL DANIELS, Email: daniel.daniels.2@us.af.mil Telephone: 4782222166 DANIEL DANIELS, Email: daniel.daniels.2@us.af.mil Telephone: 472-5268

7. ADMINISTERED BY (if other than Item 6)

CODE

SCD: PAS:

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code)

CODE: FACILITY CODE:

9A. AMENDMENT OF SOLICITATION NUMBER

FA852326QB003

9B. DATED (SEE ITEM 11)

15 Sep 2026

10A. MODIFICATION OF CONTRACT/ORDER

NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; 1 or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (if required) See Section G - Contract Administration Data

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK

ONE

A.THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.)

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

See Schedule

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

16C. DATE SIGNED

Computer generated. Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA-FAR (48 CFR) 53.243

Created On:

23 Sep 2026, 12:53 PM Eastern Daylight Time

SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

The purpose of this amendment is to: (1) Reopen and extend the solicitation response period; (2) Replace the Block 14 (Description of Amendment/Modification):

Performance Work Statement (PWS); (3) Revise applicable solicitation clauses (including updating the required CMMC Certification Level); and (4) Update and replace the Contract Data Requirements List (CDRL) DD1423-1 document.

A. The solicitation response period, which closed on 22 September 2026, is hereby reopened and extended as follows:

FROM: 5:00 PM 22 September 2026 TO: 5:00 PM 24 September 2026

B. The Performance Work Statement (PWS) originally solicited is hereby replaced in its entirety as follows:

FROM: EWASP Sustainment Support PWS_15Sep2026 TO: EWASP Sustainment Support PWS_23Sep2026 (Attached)

C. The following clauses are hereby removed from the solicitation:

DFARS 252.204-7004 Antiterrorism Awareness Training for Contractors (Jan 2023) FAR 52.217-8 Option to Extend Services (Nov 1999)

D. The following clause is hereby revised to update the specific certification level required for performance:

DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements (Nov 2025) -The required CMMC certification level is hereby changed FROM Level 2 (Self) to Level 1 (Self)

E. The following clause is hereby incorporated DFARS 252.204-7023 Reporting Requirements for Contracted Services (Jul 2021)

F. ELINs A/B/C001 and A/B/C002 are hereby deleted

G. The Contract Data Requirements list (CDRL) DD1423-1 document is hereby replaced in its entirety FROM: EWASP Sustainment CDRL Package TO: EWASP Sustainment CDRL Package_23Sep2026

H. All other terms and conditions shall remain unchanged and in full force and effect

Solicitation/Contract Form

The following modifications were made:

Information From To Response Due Date 22 Sep 2026 24 Sep 2026 Solicitation Number FA852326QB003 FA852326QB0030001

Supplies or Services & Prices or Costs

Line Item 0004

The following Line Item modifications were made:

Information From To ELINs A001, A002, A003, A004 A003, A004

Line Item A001

The following Line Item(s) were deleted:

Item Supplies / Services Quantity Unit Unit Price Amount

A001 Service Engineering Report

Product Service Code: R425 Pricing Arrangement: Firm Fixed Price

1 Lot Not Separately Priced

FA852326QB0030001

Line Item A002

The following Line Item(s) were deleted:

Item Supplies / Services Quantity Unit Unit Price Amount

A002 Technical Report - Study/Service

Product Service Code: R425 Pricing Arrangement: Firm Fixed Price

1 Lot Not Separately Priced

Option Line Item 1004

The following Line Item modifications were made:

Information From To ELINs B001, B002, B003, B004 B003, B004

Option Line Item B001

The following Line Item(s) were deleted:

Item Supplies / Services Quantity Unit Unit Price Amount

Option Line Item B001

Service Engineering Report

Product Service Code: R425 Pricing Arrangement: Firm Fixed Price

1 Lot Not Separately Priced

Option Line Item B002

The following Line Item(s) were deleted:

Item Supplies / Services Quantity Unit Unit Price Amount

Option Line Item B002

Technical Report - Study/Service

Product Service Code: R425 Pricing Arrangement: Firm Fixed Price

1 Lot Not Separately Priced

Option Line Item 2004

The following Line Item modifications were made:

Information From To ELINs C001, C002, C003, C004 C003, C004

Option Line Item C001

The following Line Item(s) were deleted:

Item Supplies / Services Quantity Unit Unit Price Amount

Option Line Item C001

Service Engineering Report

Product Service Code: R425 Pricing Arrangement: Firm Fixed Price

1 Lot Not Separately Priced

Option Line Item C002

The following Line Item(s) were deleted:

Item Supplies / Services Quantity Unit Unit Price Amount

Option Line Technical Report - Study/Service

Item C002

Product Service Code: R425 Pricing Arrangement: Firm Fixed Price

1 Lot Not Separately Priced

Inspection and Acceptance

Line Item A001

The following Inspection and Acceptance Location(s) were deleted:

Inspection and Acceptance Location - DoDAAC: F3QCDG

Line Item A002

The following Inspection and Acceptance Location(s) were deleted:

Inspection and Acceptance Location - DoDAAC: F3QCDG

Option Line Item B001

The following Inspection and Acceptance Location(s) were deleted:

Inspection and Acceptance Location - DoDAAC: F3QCDG

Option Line Item B002

The following Inspection and Acceptance Location(s) were deleted:

Inspection and Acceptance Location - DoDAAC: F3QCDG

Option Line Item C001

The following Inspection and Acceptance Location(s) were deleted:

Inspection and Acceptance Location - DoDAAC: F3QCDG

Option Line Item C002

The following Inspection and Acceptance Location(s) were deleted:

Inspection and Acceptance Location - DoDAAC: F3QCDG

Deliveries or Performance

Line Item A001

The following Delivery Information was deleted:

Period of Performance

Line Item A002

The following Delivery Information was deleted:

Period of Performance

Option Line Item B001

The following Delivery Information was deleted:

Period of Performance

Option Line Item B002

The following Delivery Information was deleted:

Period of Performance

Option Line Item C001

The following Delivery Information was deleted:

Period of Performance

Option Line Item C002

The following Delivery Information was deleted:

Period of Performance

Contract Clauses

Header Miscellaneous Text (Added):

252.204-7023 Reporting Requirements for Contracted Services. Basic. As prescribed in 204.208-71(a)(1) and (2),:

Reporting Requirements for Contracted Services--Basic (Jul 2021)

Additional Regulation or Supplemental Clauses Incorporated by Full Text

The following Clause modifications were made:

252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements. Nov 2025 hereby reads as follows:

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) . As used in this clause- Definitions

"Controlled unclassified information" means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

"Current" means-

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status-

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status-

(i) Not older than 1 year for Final Level 1 (Self), with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

"Cybersecurity Maturity Model Certification (CMMC) status" means the result of meeting or exceeding the minimum required score for the corresponding assessment.

The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

"Cybersecurity Maturity Model Certification unique identifier (CMMC UID)" means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.

"Federal contract information (FCI)" means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

"Plan of action and milestones" means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication

800-115 (32 CFR 170.21).

(b) . The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's compliance with applicable information security Framework protections (see 32 CFR part 170).

(c) . The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances when a reassessment Duplication may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) . The Contractor shall- Requirements

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: for all information CMMC Level 1 (Self) systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required in paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) ( ) for each https://piee.eb.mil CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) . The Contractor shall- Reporting

(1) Submit to the Contracting Officer-

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract;

and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2) Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) . The Contractor shall- Subcontracts

(1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items, if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.

(End of clause)

The following Clause(s) were deleted:

FAR Clauses Incorporated by Full Text 52.217-8 Option to Extend Services. (Nov 1999)

Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 1 Calendar day.

(End of clause)

DFARS Clauses Incorporated by Reference

Number Title Effective Date Alternate/ Deviation

Variation Effective

Date 252.204-7004 Antiterrorism Awareness Training for Contractors. Jan 2023

List of Attachments

The following Header Attachment(s) were added:

Information Value Attachment Description Contract Data Requirements List (CDRL) Attachment Name EWASP Sustainment CDRL Package_23Sep2026 Date 23 Sep 2026 Number 04

Information Value Attachment Description Performance Work Statement Attachment Name EWASP Sustainment Support PWS_23Sep2026 Date 23 Sep 2026 Number 03

The following Header Attachment(s) were deleted:

EWASP Sustainment CDRL Package EWASP Sustainment Support PWS_15Sep2026