Solicitation Amendment N6600126R00020001 SF 30.pdf

R

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

16C. DATE SIGNED

Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE PAGE OF PAGES

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X) 9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBE

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

Created On:

08 Apr 2026, 22:12 PM Greenwich Mean Time

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

Section A - Solicitation/Contract Form

The following changes have been made:

INFORMATION FROM TO

Header only - Purchase Requisition Number

AMS00684952

Response Due Date 20 Apr 2026 24 Apr 2026

N6600126R00020001

Section I - Contract Clauses

Additional Information/Notes

The following clauses were added:

DFARS Clauses Incorporated by Full Text

252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements.

(Nov 2025)

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) . As used in this clause- Definitions

"Controlled unclassified information" means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

"Current" means-

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status-

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR

170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status-

(i) Not older than 1 year for Final Level 1 (Self), with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

"Cybersecurity Maturity Model Certification (CMMC) status" means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

"Cybersecurity Maturity Model Certification unique identifier (CMMC UID)" means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.

"Federal contract information (FCI)" means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

"Plan of action and milestones" means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication 800-115 (32 CFR 170.21).

(b) . The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's compliance with Framework applicable information security protections (see 32 CFR part 170).

(c) . The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances Duplication when a reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) . The Contractor shall- Requirements

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: ____ for all information Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC) systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required in paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) ( ) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI https://piee.eb.mil or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) . The Contractor shall- Reporting

(1) Submit to the Contracting Officer-

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract; and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2) Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) . The Contractor shall- Subcontracts

(1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items, if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.

(End of clause)

Section J - List of Attachments

The following attachments were added:

Att_5_Past_Performance_Questionnaire Rev1 Att_6_QandA

The following attachments were deleted:

Att_5_Past_Performance_Questionnaire

Section L - Instructions, Conditions, & Notices to Offerors or Quoters

The following clauses were added:

DFARS Clauses Incorporated by Full Text

252.204-7025 Notice of Cybersecurity Maturity Model Certification Level Requirements. (Nov 2025)

NOTICE OF CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) . As used in this provision, "controlled unclassified information (CUI)," "current," "Cybersecurity Maturity Model Certification Definitions (CMMC) status," "Cybersecurity Maturity Model Certification unique identifier (CMMC UID)," "Federal contract information (FCI)", and "plan of action and milestones" have the meaning given in the Defense Federal Acquisition Regulation Supplement 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, clause of this solicitation.

(b)(1) . The CMMC level required by this solicitation is: Cybersecurity Maturity Model Certification (CMMC) level ____ [Contracting Officer . This CMMC level, or higher (see 32 insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)]

CFR part 170), is required prior to award for each contractor information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the contract.

(2) The Offeror will not be eligible for award of a contract, task order, or delivery order resulting from this solicitation if the Offeror does not have, for each of the contractor information systems that will process, store, or transmit FCI or CUI and that will be used in performance of a contract resulting from this solicitation-

(i) The current CMMC status entered in the Supplier Performance Risk System (SPRS) ( ) at the CMMC level https://piee.eb.mil required by paragraph (b)(1) of this provision; and

(ii) A current affirmation of continuous compliance with the security requirements identified at 32 CFR part 170 in SPRS.

(c) . If the Offeror has a CMMC Status of Conditional, the Offeror shall successfully close out a valid plan of Plan of action and milestones action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(d) . The Offeror shall provide, in the proposal, the CMMC unique identifier(s) (CMMC UIDs) issued by SPRS for CMMC unique identifiers each contractor information system that will process, store, or transmit FCI or CUI during performance of a contract, task order, or delivery order resulting from this solicitation. The Offeror also shall update the list when new CMMC UIDs are generated in SPRS. The CMMC UIDs are provided in SPRS after the Offeror enters the results of self-assessment(s) for each such information system.

(End of provision)

Section M - Evaluation Factors for Award

The following clauses were modified:

M-215-PAC001 Evaluation Criteria and Basis for Award Feb 2025 hereby reads as follows:

The Government intends to competitively award multiple Indefinite-Delivery, Indefinite-Quantity (IDIQ) contracts utilizing the process of evaluation described herein. This source selection will be conducted in accordance with Federal Acquisition Regulation (FAR) Part 15, as supplemented by the Department of Defense (DoD) Federal Acquisition Regulation Supplement (DFARS), Navy Marine Corps Acquisition Regulation Supplement (NMCARS), and the (DoD) Source Selection Procedures, 01 April 2016.

Price or cost will not be evaluated in accordance with FAR 15.104(b)(1)(ii)(A).

(a) The contract(s) resulting from this solicitation will be awarded to all qualifying offeror(s) as defined in FAR 2.101.

(b) Proposals will be evaluated using a three-step methodology to determine the qualifying offeror(s). Step One is an evaluation of Acceptability of the Offer. Step Two is an evaluation of Capability (Organizational Experience, Past Performance). Step Three is the source selection decision, where contracts will be awarded to all qualifying offerors that: are determined to be a responsible source;

submit a technically acceptable proposal that conforms to the requirements of the solicitation; and the Contracting Officer has no reason to believe would be likely to offer other than fair and reasonable pricing. The Government will not perform a tradeoff analysis.

A technically acceptable proposal is a proposal that receives a rating of Acceptable or above in all evaluation factors, other than Past Performance. For the Past Performance factor, an offeror must receive a Performance Confidence Assessment rating of Neutral Confidence, Satisfactory Confidence, or Substantial Confidence.

The Government will not evaluate price or cost as a factor under this solicitation. Instead, the Government will consider price or cost as one of the factors in the selection decision for each task or delivery order under this multiple award contract, in accordance with FAR 16.501-5(b)(2)(ii).

(c) Evaluation of an offeror's proposal shall be based on the information presented in the proposal and information available to the contracting office from sources deemed appropriate. Sources typically considered include Defense Contract Audit Agency, Defense Contract Management Administration offices, other contracts with same firms for similar items or services, known commercial sources such as Data Resources, Inc., Standard and Poor, etc. If the proposed contract requires the delivery of data, the quality of organization and writing reflected in the proposal will be considered an indication of the quality of organization and writing which would be prevalent in the proposed deliverable data. Subjective judgment on the part of the Government evaluators is implicit in the entire process.

(d) Each proposal will be evaluated using the following methodology:

1.0 STEP ONE - Acceptability of Offer

1.1 Acceptability of the Offer

The Government will determine the acceptability of each offer on an Acceptable / Unacceptable basis. The Government will consider an offer to be acceptable when it manifests the offeror's assent, without exception or imposition of condition, to the terms and conditions of this Request for Proposals (RFP), including attachments and documents incorporated by reference. If an offeror takes exception to any of the terms and conditions of the RFP, imposes additional conditions or omits material information required by this RFP, the Government may consider the offer to be unacceptable. Unacceptable offers can only be corrected through discussions (see FAR 15.204-2). The Government reserves the right to change the terms and conditions of this RFP by amendment at any time prior to the source selection decision.

2.0 STEP TWO - Evaluation of Capability

Factor 1: Organizational Experience

Experience is the opportunity to learn by doing. An offeror’s organizational experience is relevant when it has been confronted with the kinds of challenges it will likely face under the contract contemplated by this RFP. This evaluation will consider the breadth, depth and relevance of offeror organizational experience since 01 January 2021 in the Key Areas identified in provision Section L, Submission of Proposals. Relevance may include, but is not limited to, similarity to work contemplated under the RFP with respect to complexity, length of performance, scope, type of work, and value.

For evaluation purposes, ratings may be maximized for offerors who, in accordance with Section L, Submission of Proposals, cited organizational experience references that collectively demonstrate maximum breadth and depth of relevant experience in the Key Areas. In evaluating your experience in each individual Key Area, the Government will consider only the text designated in Block 17 of the Reference Information Sheet for that particular Key Area. For evaluation purposes, it should also be noted that these Key Areas will not be evaluated as subfactors.

Factor 2: Past Performance

The past performance evaluation is an assessment of the offeror’s probability of meeting the solicitation requirements. The past performance evaluation considers the offeror’s demonstrated recent and relevant record of performance in supplying products and services that meet the contract’s requirements and, specifically, in the Key Areas. In accordance with FAR 15.202(c)(3)(ii), the currency and relevance of the information, source of the information, context of the data, and general trends in contractor’s performance shall be considered. These are combined to establish one performance confidence assessment rating for each offeror.

There are three aspects to the past performance evaluation. The first is to evaluate the recency of the offeror’s past performance. To be deemed recent, the work must have been performed since 1 January 2021. If a reference is not deemed recent, that reference will not be evaluated in the second or third aspects of this evaluation factor.

The second aspect is to evaluate the collective relevance of the offeror’s past performance. An offeror’s past performance is relevant when it is similar to the kinds of challenges that may occur under the contract contemplated by this RFP, specifically in the Key Areas. Relevance may include, but is not limited to, similarity to work contemplated under the RFP with respect to complexity, length of performance, scope, type of work, and value. Past Performance relevancy will be rated as follows: , Very Relevant Relevant, , or .Somewhat Relevant Not Relevant

The third aspect of the past performance evaluation is to establish the overall quality and usefulness of the offeror’s past performance. Only recent past performance deemed or better will be evaluated in this third aspect. The Government will consider past performance Somewhat Relevant information (e.g., CPARS, Reference Information Sheets submitted by offerors, Past Performance Questionnaires submitted by offeror references, their own experience with offerors, and information from third-party references) as it relates to the following areas to determine the quality and usefulness as it applies to a performance confidence assessment:

(1) Quality - Conformance to contract requirements, specifications and standards of good workmanship, accuracy of reports, technical excellence, reliability.

(2) Schedule - Timeliness of performance with regard to contract milestones, delivery/performance schedules, administrative requirements, actions that contribute to or affect schedule variance, contractor corrective actions.

(3) Cost Control - Effectiveness in forecasting, managing and controlling contract cost; demonstrated sense of cost responsibility, efficient use of resources, cost savings; current, accurate and complete billings; actual cost/rates reflect closely to negotiated cost/rates.

(4) Management - Integration and coordination of all activity needed to execute the contract, specifically the timeliness, completeness and quality of problem identification, corrective action, history of reasonable and cooperative behavior, customer satisfaction;

responsiveness; subcontract management (when applicable); program management; management of key personnel (when applicable).

(5) Utilization of Small Business - Effective program to maximize the participation of small business concerns in Federal agency contracts. Compliance with FAR 52.219-8 “Utilization of Small Business Concerns.” Compliance with FAR 52.219-9 “Small Business Subcontracting Plan” (applicable only if FAR 52.219-9 is included in this solicitation).

(6) Regulatory Compliance - Compliance with all terms and conditions in the contract relating to applicable regulations and codes, to include – when applicable – compliance with financial, environmental, safety and labor regulations as well as any reporting requirements.

If Block 1 of the Reference Information Sheet (Attachment 4) includes a proposed team member (i.e., proposed prime or subcontractor), this reference will be considered when evaluating organizational experience, but will not be considered when evaluating past performance.

The Government will review this past performance information and determine the quality and usefulness as it applies to a performance confidence assessment as follows: , , , , or .Substantial Confidence Satisfactory Confidence Neutral Confidence Limited Confidence No Confidence Note: Pursuant to FAR 15.202(c)(i), an offeror without a record of relevant past performance, or for whom information on past performance is not available, may not be evaluated favorably or unfavorably on past performance. Such offerors will receive a neutral rating of . Neutral Confidence

3.0 STEP THREE - Source Selection Decision

Contracts will be awarded to all qualifying offeror(s) that are determined to be a responsible source; submit a technically acceptable proposal that conforms to the requirements of the solicitation; and the Contracting Officer has no reason to believe would be likely to offer other than fair and reasonable pricing. The Government will not perform a tradeoff analysis.

A technically acceptable proposal is a proposal that receives a rating of Acceptable or above in all evaluation factors, other than Past Performance. For Past Performance, an offeror must receive a confidence assessment rating of Neutral Confidence, Satisfactory Confidence, or Substantial Confidence for the Past Performance factor.

53560 HULL STREET, SAN DIEGO CA 92152-5001

SAN DIEGO, CA 92152-5001

UNITED STATES

Eric Pomroy, Email: eric.r.pomroy.civ@us.navy.mil Telephone: 808-635-6304 AdminBy:

SCD: PAS: