DPAA AMEND 3 VENDOR SIGN.pdf

This is an Amendment of Solicitation/Modification of Contract (Standard Form 30) issued by USTRANSCOM-AQ on October 26, 2020, modifying contract HTC711 with an effective date of October 26, 2020. The amendment updates clause 252.204-7021 regarding Contractor Compliance with the Cybersecurity Maturity Model Certification (CMMC) Level Requirements, effective November 2025. The modification was signed by Contracting Officer Brenda L. Marshall on October 26, 2026.

The key changes include revised CMMC compliance requirements for contractors maintaining current CMMC status at CMMC Level 1 (Self) or higher for all information systems used in contract performance that process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Contractors with Conditional CMMC Status must successfully complete a valid plan of action and milestones to achieve Final status. Requirements specify submission of CMMC Unique Identifiers (UIDs) in the Supplier Performance Risk System (SPRS), annual affirmations of continuous compliance by an affirming official, and flow-down requirements to subcontractors and other contractual instruments. The amendment also modified the Notice of Cybersecurity Maturity Model Certification Level Requirements (clause 252.204-7025) for solicitation provisions. Updated attachments include the Performance Work Statement (Attachment 1: PWS Track Changes 20261026) and Business Compliance Checklist (Attachment 4: Business Compliance Checklist OCT 26).