Solicitation Amendment N0018926QL2150002 SF 30.pdf

R

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

16C. DATE SIGNED

Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE PAGE OF PAGES

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X) 9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBE

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

Continuation of Supplies or Services and Prices/Costs

The following CLIN(s) / SLIN(s) / ELIN(s) were added:

Item Supplies / Services Quantity Unit Unit Price Amount

Technical Support in accordance with minimum requirements Product Service Code: DA10 Signal Code: A Requesting Organization: N4-PARKS Pricing Arrangement: Firm Fixed Price

1 Lot

The following CLIN(s) / SLIN(s) / ELIN(s) were modified:

INFORMATION FROM TO

Description Micro Desktop in accordance with minimum requirements

Micro Desktop or equivalent media player architecture in accordance with minimum requirements

INFORMATION FROM TO

Description Desktop wall mount in accordance with minimum requirements

Desktop or equivalent media player architecture wall mount in accordance with minimum requirements

INFORMATION FROM TO

Description All services in accordance with minimum requirements Installation, Assistance, and training services in accordance with minimum requirements

N0018926QL2150002

Continuation of Description

Miscellaneous text in this section has been modified to:

Minimum Requirements

Explosive Ordinance Disposal Group Two

1. Background: Headquartered at Joint Expeditionary Base Little Creek-Fort Story (JEBLC-FS) in Virginia Beach, Virginia, Explosive Ordinance Disposal Group Two (EODGRU TWO) is a critical Echelon IV component of the Navy Expeditionary Combat Command (NECC). EODGRU TWO oversees all east coast-based operational units. The command's mission is to clear explosive hazards to provide access to denied areas, secure undersea domain, and protect the homeland.

2. Scope: EODGRU TWO has a requirement for interactive touchscreen displays to chronicle the history of Navy Explosive Ordinance Disposal (EOD). This critical modernization effort will dynamically preserve the community's legacy and enhance command heritage. Interactive touch screens will display photos, video's, URL's, etc. that can be searchable for specific information and be upgradable through a cloud-based management system.

It will include the procurement. delivery, installation/assembly of the interactive touchscreen displays, and follow on support.

3. Requirements: EODGRU TWO requires the following supplies and associated services

Supplies:

(3) 55 inch interactive touch screen monitors with anti-glare capabilities. Resolution: 3840 x 2160 @ 60hz, HDMI, USB type A & B, Display Port

(3) Wall mounts to hold 55-inch touch screen monitors

(3) Micro Desktops, Windows 11 or comparable, WIFI-6, 8 GB Memory, 256 GB SSD or an equivalent media player architecture to host signage application/software.

(3) Wall mounts for Desktops or equivalent media player architecture

(3) 1-Year Software subscription to maintain cloud-based support and updates to software

All associated cables

Services:

Installation and assembly of interactive touch screens, monitors, and associated hardware.

- The (3) 55-inch touchscreens shall be mounted in portrait format side by side. This allows for (6) continuous rails of cards to be running at all times.

- See attached photo for layout example and installation location.

Assistance in designing layout and content of information to be displayed

Training of personnel on how to use and update information in the display

- Minimum of two (2) training sessions

Technical Support and Updates

- Shall consist of weekly service calls/support hours, Support hours shall not exceed four (4) hours per week

Questions and Answers

1. What is the preferred interactive display brand, or are equivalent brands acceptable? There is no brand requirement. All items/services must meet the minimum requirements

2. Is the cloud CMS software required to be FedRAMP approved, or will commercial software be acceptable? Commercial software is acceptable as these are standalone systems not connected to the NMCI network.

3. Will the Government provide the electrical power and network connection, or is the contractor responsible? Yes, the government will provide electrical power and network connection.

4. Is content creation limited to assisting with layout, or must the contractor develop all photos, videos, and historical content? Contractor shall assist in providing guidance regarding layout, size and quality of photos, videos, and other media.

5. Will the government provide all media (photos, videos, documents), or must the contractor source and digitize them? Government will provide all media. Contractor assistance may be required if media is not acceptable due to size.

6. Are there any security or CAC authentication requirements for the software? There are no security or CAC authentication requirements for software.

7. Is after hours installation required? No.

8. Are there any base access requirements or security clearances for installers? Yes, base access is required. Contractors will be required to apply for a base access permit (paperwork will be provided to the awardee) and will be required to have a military ID or Real ID to access the base.

Contractor will have to be escorted when installing in our building.

9. Are existing wall structures suitable for mounting, or is reinforcement required? Existing wall is cinderblock and suitable for mounting.

10. What is the approximate distance from power/network outlets to each display? 110V outlet is approximately 2-3 ft under where touchscreens will be mounted.

11. Is onsite training required for one session only, or multiple sessions? A minimum of two (2) sessions are required.

12. Does the one-year software subscription include technical support and updates, or should these be quoted separately? No, these should be quoted separately, please see CLIN 0008 and minimum requirements for technical support and updates.

13. Is the contractor responsible for removing or relocating any existing wall equipment before installation? No, there is nothing to remove, Cinderblock wall block has nothing attached to it.

14. Are there any preferred installation dates or blackout periods? Non-availability dates are Labor Day holiday from 4-7 Sep 2026.

15. All associated cables: Could you please clarify whether this refers only to the standard cables required to connect the supplied equipment (such as power, HDMI, USB, DisplayPort, etc.), or should we include any additional cables required for the installation, such as extended or in-wall cabling, network cables, or cable management materials? Only standard cables required to connect the equipment supplied (power, HDMI, USB, DisplayPort, etc.)

16. Installation: Could you please clarify the expected scope of installation? Specifically, should installation include mounting the interactive displays and micro desktops, cable routing and management, equipment configuration, testing, and any user orientation or training? Yes, all of the above, as applicable, should be included in installation.

17. 1-Year software subscription: The RFQ references a "1-Year Software subscription to maintain cloud-based content and technical support with (4) option year periods." could you please specify whether there is a preferred software platform or manufacturer, or may offerors propose an equivalent cloud-based content management support solution? Option years have been removed. Quoters can quote an equivalent cloud-based content management and support solution, as they see fit and if this meets the minimum requirements. The content will be constantly updated by adding new media to include photos, videos, documents throughout the year.

18. In box 17a, on the first page of the document, there are two boxes asking for "Code" and "Facility Code". Would you please help me with where I can obtain the answers for these boxes? The "Code" box refers to the SAM assigned Contractor CAGE Code. The "Facility Code" box refers to an alternate CAGE Code. This only applies when work will be performed at a contractor facility with a different CAGE code than the Contractor's main location.

19. Please confirm whether the Windows 11 micro desktops are mandatory, or whether an equivalent contractor-provided media player architecture would be acceptable if it meets the functional requirements. An equivalent contractor-provided media player architecture would be acceptable if it meets the functional requirements.

20. Could you please clarify the intended use of the windows 11 micro desktops? Are they intended only to run the interactive touchscreen signage application, or will they also be used by personnel for other business or desktop functions? They are intended only to run the interactive touchscreen signage application.

21. Could you please clarify the intended purpose of the cloud-based content management system? For example, should it be used to manage interactive historical content such as photos, videos, URL's searchable records, and screen layout updates, or is a different content workflow expected? Purpose of the cloud-based content management system is to manage interactive content updates such as photos, videos, URLs, searchable records, and screen layout updates. The content will be constantly updated with new and additional information.

22. Are there any specific requirements for the software subscription beyond cloud-based content management and technical support? No. It will only be used for cloud-based content management and technical support.

23. Will network access be available at the installation location, and should the solution be designed for wired Ethernet, Wi-Fi, or either? Network access will be through Wi-Fi.

24. For installation, will power and network connections already be available at the wall location shown in the attachment? Yes, there is a 110V outlet available on the wall where the touchscreens will be mounted.

25. Are full-motion TV mounts required so the customer can access the hardware behind the displays? Yes, access to the back of the displays is required for easy access to cable ports and any required maintenance.

26. Does the customer have a program or application designed or in mind for use on the computers? No, we are relying on the expertise of the contractor to provide that.

27. Would the customer accept a substitution for a computer with a media player that allows them to update the program on the card with an excel file referencing photos and videos loaded onto the player instead of using a cloud-based program? No substitutions, the cloud-based program is required.

28. DFARS 252.204-7025 is incorporated on page 36 solicitation, however paragraph (b)(1) is blank where the required CMMC level should be identified. Please confirm the required CMMC level. Clause has been updated to CMMC level 1.

29. In order to determine the applicable security requirements and impacts to the proposed software solution, can you please confirm whether contractor personnel or contractor information systems will process, store, or transmit CUI or FCI during contract performance. Federal Contract Information (FCI).

30. Section 3 of the Minimum Requirements on page 4 states "(3) 1-Year software subscription to maintain cloud-base content and technical support with (4) option year periods." however, the schedule only includes a single FFP CLIN for the one-year software subscription and does not identify option CLINs for the four additional years. Please clarify how offerors should price the four option years for software subscription and technical support with the current CLIn, or if the Government will issue an amendment to add option CLIN. The minimum requirements has been amended to remove the option year periods. Please quote according to one (1) year.

31. For option year technical support, should these be priced as FFP or T&M? Option years have been removed but all CLINs are FFP.

32. Who will provide the content and in what format will it be delivered? EODGRU2 will be providing all media (photos, videos, documents, information). Content (layout, orientation, display) shall be developed by contractor.

33. What is the software reference as Line 007, page 3? is that our content management system or is that something that is supplied by EODGRU TWO? The government is no providing any content management system (CMS). The contractor should quote and provide the CMS.

34. We have completed numerous similar installations, typically focused on informational and visual content (images, data, etc.). Could you clarify the specific need for interactivity? Interactive systems introduce significant software complexity and cost, particularly when comparing traditional HD displays to touchscreen solutions. We require a standard graphical user interface (GUI) that allows a person to operate applications through intuitive icons, buttons, and windows rather than typing text commands.

35. The RFP specifies three screens. Would a single large-format display be an acceptable alternative to reduce system complexity, CPU count, and mounting costs? No, a single large-format display is unacceptable. Multiple displays allows multiple personnel to interact with screens.

36. Will network connectivity (Wi-Fi or Ethernet) be provided at the installation site? See question 23.

37. Will personnel providing software support require a security clearance, or is a favorable background investigation sufficient? No security clearance required.

38. CMU wall, cable pathway, and display orientation. Thank you for the wall location photo. Please confirm three related points: (a) the mounting wall is painted concrete-masonry-unit (CMU / cinder block) construction throughout the intended display footprint, with no drywall furring or internal cavity for cable pathway; (b) whether the Government will provide a new electrical outlets and Cat6 network drop directly behind the display array (Government-furnished rough in) or the contractor should include running surface-mount raceway (Wiremold or equal, painted to match) from the nearest existing outlet and drop in the services lot; and (c) that the RFQ's written PORTRAIT orientation governs, notwithstanding the landscape appearance of the blue rectangles in the wall-location photo mockup. (a) (b) YES No additional electrical outlet required. Existing 110V outlet directly under the mounting area should suffice. No CAT 6 drop required as it will be done through WiFi, nearest electrical outlet is

(c) approximately 2-3' directly under the mounting area a short raceway will be required. Portrait Format is required for the orientation of the touchscreens.

39. Network integration for the micro desktops. Will the (3) Windows 11 micro desktops need to join a Navy / NMCI domain or connect to any NMCI / OneNet resource, or will they operate as standalone appliances on a public or segregated content-only network. This determines STIG hardening scope, imaging requirements, ATO / ATC scope, and whether CAC-reader hardware is needed NO CACs will be required. There is no requirement for desktops to join the Navy / NMCI network, this is a standalone appliance on a public / segregated Wi-Fi network, NO CACs required.

40. Cloud CMS platform preference "cards /rails" architecture. The RFQ requires a cloud-based CMS supporting photos, videos, URLs, and searchable content, with the content displayed as "(6) continuous rails of cards" accross the three portrait displays. Please confirm: (a) whether the government has a preferred CMS platform (Intuiface, Yodeck, ScreenCloud, Samsung MagicINFO Cloud, EloView, Rise Vision, LG SuperSign, etc.)

or any DoD-approved commercial CMS is accpetable and (b) whether "cards" and "rails" is being used generically for any tile-based CMS layout or whether specific CMS with a native card-rail authoring model (e,g,. Intuiface) is expected. (a) The government has no preferred Content

(b) Management System (CMS), Yes the terms "cards" and "rails" are being used generically for any tiles based CMS layout.

41. Delivery date firmness on the supply CLINs. The Government-specified delivery date for supply CLINs 0001-0005 is 10 August 2026 - roughly 33 calendar days from the anticipated award date. Commercial lead times on 55" interactive displays and Dell OptiPlex micro units typically run 15- 30 business days. Is the government amendable to a firm delivery window of "30 days after award," or will an award-day slip trigger a strict enforcement of the 10 August date? A firm-relative window lets small-business offerors avoid pricing air-freight premiums into the base price.

Timelines have been revised in the RFQ.

42. Contractor access to the installation site. Will the awarded contractor install team need Common Access Cards (CACs) for physical access to Building 2520 Midway Road, or will visitor / escorted access via the command security manager (CSM) suffice? If CACs are required, please identify the sponsoring CSM or COR and the requried background-investigation tier. No CAC required. Please see question (8).

43. CMMC level required for award. DFARS 252.204-7025 (Notice of CMMC Level Requirements) is included in the solicitation, but the required CMMC level line has been left blank. Please confirm the CMMC level required for award (Level 1 Self, Level 2 Self, Level 2 C3PAO, or Level 3 DIBCAC), or confirm that this acquisition does not involve Federal Contract Information (FCI) or Controlled unclassified Information (CUI) on contractor information systems and CMMC does not apply. Clause has been updated to CMMC Level 1.

44. Set-aside category and brand-name-or-equal evaluation. Please confirm two administrative points that affect the way we submit the quote: (a) the specific Small business set-aside category to this acquisition (block 10 lists SB, WOSB, HUBZone, SDVOSB,EDWOSB, and 8(a) - Contractor qualifies under any of them, but the quote form asks us to represent under a specific one); and (b) confirmation that a brand-name-or-equal evaluation applies to the display, micro-desktop, mount, and CMS specifications, so offerors can propose TAA-compliant equivalents (e,g., Samsung QM-C-T vs LG TR3DK vs ViewSonic IFP). Small Business (SB) set-aside. No brand name requirement, quoters must meet minimum requirements.

45. Since the Government requires both software and technical support as a single FFP line item, can an estimated LOE (e,g., anticipated service calls or support hours) be provided to facilitate consistent pricing among offerors? This has been broken up into separate CLINs. The anticipated support hours would be weekly updates with no more than four (4) support hours per week. Please see CLIN 0008 and the updated minimum requirements.

46. FedRAMP authorization requirement for the cloud CMS provider. Is FedRAMP Moderate (or higher) authorization required for the cloud CMS provider under CLIN 0007? This requirement, if applied, would narrow the supplier list considerably and materially affect the subscription price on the bas year and all four option years. FedRAMP authorization not required, Commercial software acceptable. minimum requirements updated to remove option years.

Continuation of Inspection and Acceptance

The inspection and acceptance locations for the following CLIN(s) / SLIN(s) / ELIN(s) were added:

Inspection and Acceptance Location - N55322 - EXPLOSIVE ORDNANCE DISPOSAL GROUP 2

INFORMATION VALUE

Action Both Location Other

Acceptance Location

N55322

EXPLOSIVE ORDNANCE DISPOSAL GROUP 2

2520 MIDWAY ROAD SUITE 100, VIRGINIA BEACH VA 23459

VIRGINIA BEACH, VA 23459

UNITED STATES

Instructions Inspection and Acceptance location.

POC Name Zach Greg POC Email gregory.c.zach.civ@us.navy.mil POC Telephone 948-215-2772

Continuation of Deliveries or Performance

The delivery information for the following CLIN(s) / SLIN(s) / ELIN(s) were added:

INFORMATION VALUE

Period of Performance 28 Sep 2026 to 27 Sep 2027

The delivery information for the following CLIN(s) / SLIN(s) / ELIN(s) were modified:

Ship To - N55322 - EXPLOSIVE ORDNANCE DISPOSAL GROUP 2

INFORMATION FROM TO

Delivery Delivery Requested By 10 Aug 2026. Delivery Requested By 17 Aug 2026.

Ship To - N55322 - EXPLOSIVE ORDNANCE DISPOSAL GROUP 2

INFORMATION FROM TO

Delivery Delivery Requested By 10 Aug 2026. Delivery Requested By 17 Aug 2026.

Ship To - N55322 - EXPLOSIVE ORDNANCE DISPOSAL GROUP 2

INFORMATION FROM TO

Delivery Delivery Requested By 10 Aug 2026. Delivery Requested By 17 Aug 2026.

Ship To - N55322 - EXPLOSIVE ORDNANCE DISPOSAL GROUP 2

INFORMATION FROM TO

Delivery Delivery Requested By 10 Aug 2026. Delivery Requested By 17 Aug 2026.

Ship To - N55322 - EXPLOSIVE ORDNANCE DISPOSAL GROUP 2

INFORMATION FROM TO

Delivery Delivery Requested By 10 Aug 2026. Delivery Requested By 17 Aug 2026.

INFORMATION FROM TO

Period of Performance 10 Aug 2026 to 21 Sep 2026 17 Aug 2026 to 28 Sep 2026

INFORMATION FROM TO

Period of Performance 21 Sep 2026 to 20 Sep 2027 28 Sep 2026 to 27 Sep 2027

Contract Clauses

Additional Information/Notes

The following clauses were modified:

252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements.

Nov 2025 hereby reads as follows:

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) . As used in this clause- Definitions

"Controlled unclassified information" means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

"Current" means-

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status-

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR

170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status-

(i) Not older than 1 year for Final Level 1 (Self), with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15);

and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18);

and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

"Cybersecurity Maturity Model Certification (CMMC) status" means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

"Cybersecurity Maturity Model Certification unique identifier (CMMC UID)" means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.

"Federal contract information (FCI)" means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

"Plan of action and milestones" means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication 800-115 (32 CFR 170.21).

(b) . The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's compliance with Framework applicable information security protections (see 32 CFR part 170).

(c) . The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances Duplication when a reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) . The Contractor shall- Requirements

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: CMMC Level 1 (Self) for all information systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required in paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) ( ) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI https://piee.eb.mil or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) . The Contractor shall- Reporting

(1) Submit to the Contracting Officer-

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract; and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2) Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) . The Contractor shall- Subcontracts

(1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items, if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at

32 CFR 170.23.

(End of clause)

ATTENTION CODE 301, 1968 GILBERT STREET SUITE 600

NORFOLK, VA 23511-3392

UNITED STATES

Mychael Mckay, Email: mychael.k.mckay.civ@us.navy.mil Telephone: 771-229-3630 AdminBy:

SCD: PAS: