NWP CMMC Presentation 22JAN26.pdf
PDF 1 MB Posted
- Attached to
- Industry Day - USACE Portland District
- Solicitation number
- Not on record
About this file
This is a briefing presentation from the U.S. Army Corps of Engineers Portland District on Cybersecurity Maturity Model Certification (CMMC) integration into federal contracts. The briefing is designed to orient contractors interested in doing business with Portland District on CMMC requirements and expectations, though it does not provide technical guidance on achieving certification levels.
CMMC was created to address significant and increasing cyber threats to the Defense Industrial Base (DIB) by shifting from a "trust" model to a "verify" model, ensuring contractors and subcontractors have implemented required cybersecurity protections to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program features three key elements: a tiered model with progressively advanced cybersecurity standards based on information sensitivity, assessment requirements to verify implementation of cybersecurity standards, and implementation through contracts where certain contractors handling sensitive unclassified information must achieve specific CMMC levels as a condition of award. Implementation occurs in four phased rollouts beginning in 2025, with Phase 1 requiring Level 1 or 2 self-assessments, Phase 2 (2026) requiring Level 2 certification, Phase 3 (2027) requiring Level 3 certification, and Phase 4 (2028) making CMMC a full condition of contract award. Most Portland District Northwest Projects are expected to fall into three categories: no CMMC requirement for projects with no FCI/CUI, CMMC Level 1 for contracts containing FCI but no CUI, and CMMC Level 2 self-assessment for projects generating or containing CUI. Contractors should expect to submit CMMC Unique Identifiers, maintain Approved or Provisional Status in the Supplier Performance Risk System (SPRS), and access CUI solicitation attachments only with appropriate certification levels by October 1, 2026.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Presented:
22 January 2026
Cybersecurity Maturity Model Certification (CMMC)
What it Means for Our Industry Partners
This brief is to orient Contractors interested in doing Business with Portland
District on how Cybersecurity Maturity Model Certification (CMMC) will be integrated into our contracts.
This IS NOT a how to or Technical briefing for reaching a CMMC Certification Level
Purpose
• PIEE = Procurement Integrated Enterprise Environment
• SPRS = Supplier Performance Risk System (Accessed through PIEE)
• CUI = Controlled Unclassified Information
• FCI= Federal Contract Information
• CMMC = Cybersecurity Maturity Model Certification
• C3PAO= CMMC Third-Party Assessor Organization
Key terms
• The Core Problem: Significant & Increasing Cyber Threats
• The US DIB is a primary target for adversaries seeking to steal sensitive data, intellectual property, and technical plans.
• The Impact: Protecting Our National & Economic Security
• Loss of information erodes America’s technological and military advantage.
CMMC was created to protect the DIB as a matter of national security.
• CMMC’s Goal: To Create a Unified & Verifiable Standard
• CMMC shifts the model from “trust” to “verify.” Ensures all contractors – from prime to sub – have actually implemented the required cybersecurity protections, creating a more secure and resilient supply chain for the DoD.
What is CMMC and Why Does It Exist?
5CYBERSECURITY MATURITY
MODEL CERTIFICATION (CMMC)
IMPLEMENTATION OF CMMC REQUIREMENTS
Phases Beyond Phase 1 Not likely to affect NWP Contracts
7CYBERSECURITY MATURITY
MODEL CERTIFICATION (CMMC)
SAFEGUARDING FCI AND CUI
FCI
Information that is not marked as public or for public release and is not designated as CUI Defined in FAR 52.204-21, and
FAR 4.1901
Minimum safeguarding requirement: 48 CFR 52.204-
CUI
Information that is marked or identified as requiring safeguarding in the DoD CUI Program Defined in 32 CFR Part 2002 Minimum safeguarding requirement: NIST SP 800-171
The CMMC program helps ensure that DOD contractors and subcontractors comply with DOD requirements to safeguard
FCI and CUI.
CUI BASICS
• SHARED responsibility of Government (GOV) and Contractor (KTR) personnel
• GOV responsibilities:
o Identification- Provided CUI o Communication o Marking o Safeguarding
• KTR responsibilities:
o Identification- Generated CUI o Marking o Safeguarding o Reporting – 100%, even suspected cyber incidents to DoD.
• DoD Cyber Crime Center = central node to report incidents: https://dibnet.dod.mil
• Can also report anomalous cyber activity 24/7 to: report@cisa.gov or (888) 282-0870
CMMC Level 2 (self)CMMC Level 1No CMMC Level
- Construction in non-public areas (Powerhouse)
- HVAC
- Fire Suppression Systems
- Cranes
- A/E Contracts
- Archaeological Surveys
- Water Assessments
- Services
- Complex Supplies
- Jetty Rehabilitations
- Pile Dike Rehabilitations
- Dredging
- Commercial off the Shelf Supplies
- Either the Solicitation will contain CUI or the contractor will generate Non-DOW Category CUI
Expected CUI Categories:
Water Assessments Archaeological Resources Critical Energy Infrastructure Information Protected Critical Infrastructure Information
- Contract Contains FCI but no CUI
Expected FCI Information:
Submittals Progress Payments/ Monthly Invoicing RFI’s Emails
- Contract contains no FCI and no CUI. Minimal Government to contractor interaction.
WHERE ARE NWP PROJECTS FALLING
GENERALLY?
WARNING: Each Contract will have a separate determination based on the specific requirement. This is not a binding determination for future procurements.
- IF CMMC is required, you will be asked to submit the CMMC Unique Identifier for where you will store the government information.
- Contracting Officers will check your status in SPRS
- An Approved or Provisional Status is required at time of award
- If CUI is in the solicitation, you will require the appropriate CMMC level to see the CUI attachments.
- All Solicitations with CMMC will move to the Solicitation Module of PIEE NLT 01 October 2026.
WHAT TO EXPECT FOR SOLICITATIONS
- Warfighter Acquisition University- Cyber Solutions Training Series https://www.dau.edu/cybersecurity/cyber-solutions
- CUI Registry - https://www.archives.gov/cui
- Center for Development of Security Excellence https://www.cdse.edu
- National Security Agency Contract Protection https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/
- Procurement Integrated Enterprise Environment https://piee.eb.mil
- Supplier Performance Risk System https://www.sprs.csd.disa.mil/
- DoW CIO https://dodcio.defense.gov/CMMC/Resources-Documentation/
CONTRACTOR RESOURCES
QUESTIONS?
COUNTERINTELLIGENCE, LAW ENFORCEMENT, & SECURITY DIRECTORATE (DDI(CL&S))
File details come from the government source that posted it. Updated .