Request For Proposal - W912QR-62373550- Soo Lock Fire Alarm Modernization.pdf

DEPARTMENT OF THE ARMY

U.S. ARMY CORPS OF ENGINEERS, LOUISVILLE DISTRICT

220 WEST MAIN STREET, 3RD FLOOR

LOUISVILLE, KY 40202

Contracting Division 27 August 2026

AIS INFRASTRUCTURE, LLC.

CMS CORPORATION

GEIGER BROTHERS, INC.

HOWARD W. PENCE, INC.

KIEWIT INFRASTRUCTURE CO.

SHIMMICK CONSTRUCTION COMPANY, INC.

WSP USA ENVIRONMENT & INFRASTRUCTURE INC.

Dear MATOC Contractors:

Reference is made to your Indefinite Delivery Indefinite Quantity (IDIQ) Multiple Award Task Order Contracts (MATOC), Numbers W912P523D0001 through W912P523D0007 to provide Design/Build Construction Services within the Great Lakes and Ohio River Division Mission Boundaries.

We request you submit a price proposal for the Soo Lock Fire Alarm Modernization in Sault Sainte Marie, MI as detailed in the scope of work, drawings, and specifications posted at the System for Award Management (www.SAM.gov). All vendors must be registered in the SAM database at SAM.gov. The Request for Proposal (RFP) can be found by logging into the website as a vendor and searching for the solicitation number (W912QR-62373550).

The basis for award of this task order will be based on the Lowest Evaluated Price. Factors that will be reviewed are offeror’s past performance, as found within the Contractor Performance Assessment System (CPARS), in addition to price (base plus all options). Price is considered more important than past performance. The Government will be pulling your CPARS reports and will review quality and timeliness provided on prior jobs similar in scope and magnitude in accordance with the attached scope of work. Your proposal should include a price breakdown and/or labor category table demonstrating the use of the binding rates included in your MATOC contract. The submitted price breakdown should include sufficient detail to allow the Government to verify that your proposed price incorporates the binding rates from your base contract. Any level of effort shown in the submitted information will not be used for evaluation purposes and will be used only to ensure that the proposal is in compliance with the binding rates from the base contract. Proposals that fail to submit a price breakdown or fail to use the binding rates from your MATOC will not be considered.

The Government intends to evaluate proposals and award a contract without negotiations with offerors.

Proposals submitted in response to this RFP shall be good for no less than 90 calendar days. NOTE:

The target ceiling for award is $4,000,000.00. The Government cannot guarantee that funding will be made available above this amount.

Proposals are due no later than 11:00 AM ET on 10 September 2026. Submit your proposal electronically through the Procurement Integrated Enterprise Environment (PIEE) solicitation module. Proposals not received by the stated date/time will not be considered. Please acknowledge receipt of this RFP by signing below in the space provided and returning to Megan Murphy via email at Megan.R.Murphy@usace.army.mil.

Payment and Performance Bonds will be required for this project. Performance and Payment Bonds are required within 10 days after the date of award. The Notice to Proceed will be issued after receipt and approval of the bonds.

All questions regarding this Request for Proposal (RFP) must be submitted via ProjNet. The website to access this system is www.projnet.org and the bidder inquiry key for this specific project is:

(CYF3NK-7ZP2UW). Please see ProjNet instructions included in this RFP.

If you have contractual questions, please contact Megan Murphy via email at Megan.R.Murphy@usace.army.mil. If an Offeror believes that the requirements in the RFP contain an error, omission, or are otherwise unsound; the offeror shall immediately notify the Contract Specialist in writing with supporting rationale. All Offerors is reminded that the Government reserves the right to award this RFP based on the initial proposals, as received, without discussion.

Sincerely, Patrick J. Duggins Contracting Officer

(Signature) (Date)

(Printed Name)

(Firm Name) http://www.projnet.org/

OFFEROR'S QUESTIONS AND COMMENTS

Technical inquiries and questions relating to proposal procedures or bonds are to be submitted via Offeror Inquiry in ProjNet at http://www.ProjNet.org/ProjNet. As noted below, offerors shall not submit their proposals via ProjNet. Offerors shall submit their proposals in accordance with the provisions stated in the solicitation.

To submit and review Proposal inquiry items, offerors will need to be a current registered user or self-register into system.

The Solicitation Number is: W912QR-62373550 The Offeror Inquiry Key is: CYF3NK-7ZP2UW

Specific Instructions for ProjNet Proposal Inquiry Access:

1. From the ProjNet home page linked above, click on Quick Add on the upper right side of the screen.

2. Identify the Agency. This should be marked as USACE.

3. Key. Enter the Offeror Inquiry Key listed above.

4. Email. Enter the email address you would like to use for communication.

5. Select Continue. A page will then open stating a user account was not found and will ask you to create one using the provided form.

6. Enter your First Name, Last Name, Company, City, State, Phone, Email, Secret Question, Secret

Answer, and Time Zone. Make sure to remember your Secret Question and Answer as they will be used from this point on to access the ProjNet system.

7. Select Add User. Once this is completed you are now registered within ProjNet and are currently logged into the system.

Specific Instructions for Future ProjNet Proposal Inquiry Access:

1. For future access to ProjNet, you will not be emailed any type of password. You will utilize your Secret Question and Secret Answer to log in.

2. From the ProjNet home page linked above, click on Quick Add on the upper right side of the screen.

3. Identify the Agency. This should be marked as USACE.

4. Key. Enter the Offeror Inquiry Key listed above.

5. Email. Enter the email address you used to register previously in ProjNet.

6. Select Continue. A page will then open asking you to enter the answer to your Secret Question.

7. Enter your Secret Answer and click Login. Once this is completed you are now logged into the system.

From this page you may view all offeror inquiries or add an inquiry.

Offerors will receive an acknowledgement of their question via email, followed by an answer to their question after it has been processed by our technical team.

Offerors are requested to review the specification in its entirety and to review the Offeror Inquiry System for answers to questions prior to submission of a new inquiry.

The call center operates weekdays from 8AM to 5PM U.S. Central Time Zone (Chicago). The telephone number for the Call Center is 800-428-HELP.

Offers will NOT be publicly opened. Information concerning the status of the evaluation and/or award will NOT be available after receipt of proposals.

NOTES:

1. Offerors shall not submit their proposals via ProjNet, but in accordance with the provisions stated in the solicitation. Any questions regarding acceptable means of submitting offers shall be made directly to the Contract Specialist identified in the solicitation.

2. Government responses to technical inquiries and questions relating to proposal procedures or bonds that are submitted to ProjNet in accordance with the procedures above are not binding on the Government unless an amendment is issued on Standard Form 30. In the case of any conflicts, the solicitation governs. Any changes or revisions to the solicitation will be made by formal amendment. Government responses will be limited to: (a) Notice that an amendment will be issued; (b) Reference to an existing requirement contained in the solicitation; or (c) Notice that a response is not necessary.

3. The ability to enter technical inquiries and questions relating to proposal procedures or bonds will be disabled five (5) calendar days prior to the closing date stated in the solicitation. No Government responses will be entered into the ProjNet system within two (2) calendar days prior to the closing date stated in the solicitation.

SUBMISSION INSTRUCTIONS

ELECTRONIC SUBMISSION INSTRUCTIONS

Bids: ALL SUBMISSIONS TO THIS ANNOUNCEMENT SHALL BE SUBMITTED

ELECTRONICALLY THROUGH THE PROCUREMENT INTEGRATED ENTERPRISE ENVIRONMENT

(PIEE) SOLICITATION MODULE BEFORE THE TIME SPECIFIED IN THE RFP LETTER. No paper copies, CD-ROMS, facsimile, or DoD SAFE submissions will be accepted.

A User ID and Password are required to access PIEE. Offerors are required to self-register as a Vendor or Contractor with the user's CAGE code(s) and must have an active registration in the System for Award Management (SAM) prior to the PIEE registration process.

1. Instructions for registering in PIEE:

a. Navigate to https://piee.eb.mil/

b. Select “Register” [top right],or go to https://piee.eb.mil/xhtml/unauth/registration/notice.xhtml

c. Select “Vendor”

d. Create a User ID and Password and follow the prompts [next]

e. Create Security Questions [next]

f. Complete your User Profile Information [next]

g. Complete your Supervisor or Approving Official Information [next]

h. Complete Roles:

(1) Step 1. Select SOL-Solicitation

(2) Step 2. Select Proposal Manager

(3) Step 3. Click Add Roles

(4) Step 4. Fill in your Location Code (CAGE Code) [next]

i. Provide a justification for your registration [next]

j. Follow the remaining prompts to submit your registration.

2. Instructions for Electronic Submissions in PIEE Solicitation Module:

a. Log into PIEE and select the Solicitation Icon.

b. Enter search criteria to find the solicitation. (Search Criteria can be the complete solicitation number, Solicitation Open Date, Response Due Date, Product or Service Code, NAICS, Set Aside code, Place of

Performance Zip Code, Contracting Office DODAAC, or Status).

c. The search results display. Select the Solicitation Number link to open the solicitation.

d. The solicitation displays. The information is view only.

e. Scroll down to see the Contract Information and Attachments. The Attachments can be viewed by selecting the File link. Scroll back up to the top of the screen and click the Offer tab.

f. Click the Offer tab to Add and review current offers on the Solicitation. Click the Add button to add an offer to the Solicitation.

g. Select the applicable CAGE Code for which submitting the offer for. The list is prefiltered based on the CAGEs in the Proposal Manager’s profile.

h. Upload the attachments that comprise the offer by selecting the Choose Files link.

i. After entering all necessary information enter a Signature Date and Click the Signature button.

j. The “Sign Document” pop-up window will be displayed requiring the user to enter a Digital PIN and One Time Password (OTP). Click the “Sign and Submit” button to continue.

k. After successfully adding the Offer a success message of the submission will be displayed and the offer displayed collapsed. Users may expand and view all their offers on a Solicitation.

File Size Limitations: Offerors are advised to follow the above instructions for uploading files. If needed, Offerors are advised to break the files down into smaller sections in order to upload it to the system. In such cases, please divide the sections as logically as possible and be sure to clearly name the files as specified below.

File Naming Convention:

To ensure your submission is received and processed appropriately, it is important that interested parties CAREFULLY ensure their electronic files adhere to the following naming convention:

• W912QR-62373550-FIRMNAME

Each file name shall begin with the solicitation number followed by the firm’s name and a brief file description.

Please see examples above. (***NOTE: The PIEE Solicitation Module will replace special characters and spaces in the attachment filename with underscores “__” ***)

File Organization: Although hard copies are not accepted, each file shall be clearly indexed, and logically assembled. Font size shall be 11 or larger. Pages shall be letter sized (larger page sizes (such as 11x17 fold-outs, etc.) will be counted as two pages.

Upload Completion & Deadline: Offerors are highly encouraged to become familiar with the PIEE Solicitation module well in advance of the bid due date. Interested offerors shall submit bids no later than the date specified on the solicitation document. The time & date of bid receipt will be the upload completion / delivery time & date recorded within PIEE Solicitation module. Do not assume that electronic submission will occur instantaneously. Large files will take some time to upload. Offerors should time their upload effort with prudence by not waiting until the last few minutes—this will allow for unexpected delays in the transmittal process. Offerors are encouraged to keep a copy of the upload confirmation for their record.

Submissions after the deadline will be considered late and will be processed in accordance with FAR Subpart 14.3.

Electronic Files: Files shall be in their native format (i.e. doc, xls, ppt, etc.), or if in pdf format, shall be in searchable text. Text and graphics portfolios of the electronic copies shall be in a format readable by Microsoft Office or Adobe applications. Data submitted in a spreadsheet format shall be readable by MS Excel (all cells and formulas should be unlocked).

For training and help using the PIEE Solicitation module, reference the links below.

• New User Information and Help: https://piee.eb.mil/xhtml/unauth/help/helpvendors.xhtml

• Vendor Customer Support:

https://piee.eb.mil/xhtml/unauth/web/homepage/vendorCustomerSupport.xhtml

• Solicitation - Web Based Training: https://pieetraining.eb.mil/wbt/xhtml/wbt/sol/index.xhtml

The Procurement Integrated Enterprise (PIEE) help desk may be reached by calling telephone number 866-618-5988 for assistance.

https://pieetraining.eb.mil/wbt/xhtml/wbt/sol/index.xhtml

SECTION 00 10 00 - SOLICITATION CONTRACT FORM

SECTION 00 10 00 – PRICE BREAKOUT SCHEDULE

PROJECT: The Scope of Work (SOW) is for the design and construction services required to modernize the Soo Lock Fire Alarm system in Sault St Marie, Michigan.

PROPOSER’S NAME:

ITEM

NUMBER Description UNIT AMOUNT

BASE Work For Fire

0001 Construction: All work, materials, and labor JOB $___________ required to replace the fire alarm system at Soo Locks.

0002 Design: All work and labor required to JOB $___________ design the fire alarm system at Soo Locks

TOTAL PROJECT BASE PROPOSAL $

Provide the binding contract rates and hours included in job prices above for all base and option tasks.

Project Manager _______ hours x _______ = $___________

Superintendent _______ hours x _______ = $___________

CQC Manager _______ hours x _______ = $___________

Site Safety Health Officer _______ hours x _______ = $___________

NOTES FOR CONTRACT LINE ITEM (CLIN) SCHEDULE

NOTE NO. 1. To better facilitate the receipt and proposal process, all modifications to proposals are to be submitted on copies of the latest Contract Line Item (CLIN) schedules as published in the solicitation or the latest amendment thereto. In lieu of indicating additions/deductions to line items, all Offerors should state their revised prices for each item.

NOTE NO. 2. Offerors must insert a price on all numbered items of the CLIN Schedule. Failure to do so may result in the offer being unacceptable. The basis for award is the lowest evaluated price. In accordance with 52.217-5, the Government will evaluate offers for award purposes by price.

--END OF CLIN SCHEDULE—

Section 00 70 00

Prohibition on a ByteDance Covered Application.

As prescribed in 4.2203(c), insert the following clause:

Prohibition on a ByteDance Covered Application (Jun 2023)

(a) Definitions. As used in this clause-

Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

Information technology, as defined in 40 U.S.C. 11101(6)-

(1) Means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use-

(i) Of that equipment; or

(ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product;

(2) Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but

(3) Does not include any equipment acquired by a Federal contractor incidental to a

Federal contract.

(b) Prohibition. Section 102 of Division R of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328), the No TikTok on Government Devices Act, and its implementing guidance under Office of Management and Budget (0MB) Memorandum M-23-13, dated February 27, 2023, "No TikTok on Government Devices" Implementation Guidance, collectively prohibit the presence or use of a covered application on executive agency information technology, including certain equipment used by Federal contractors. The Contractor is prohibited from having or using a covered application on any information technology owned or managed by the

Government, or on any information technology used or provided by the Contractor under this contract, including equipment provided by the Contractor's employees;

however, this prohibition does not apply if the Contracting Officer provides written notification to the Contractor that an exception has been granted in accordance with 0MB Memorandum M-23-13.

(c) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts, including subcontracts for the acquisition of commercial products or commercial services.

(End of clause)

Commencement, Prosecution, and Completion of Work (Apr 1984)

The Contractor shall be required to

(a) commence work under this contract within 10 calendar days after the date the Contractor receives the notice to proceed,

(b) prosecute the work diligently, and

(c) complete the entire work ready for use not later than 365 calendar days from Notice to Proceed. The time stated for completion shall include final cleanup of the premises.

(End of Clause)

52.211-12 Liquidated Damages -- Construction (Sept 2000)

(a) If the Contractor fails to complete the work within the time specified in the contract, the Contractor shall pay liquidated damages to the Government in the amount of $5,175.00 for each calendar day of delay until the work is completed or accepted.

(b) If the Government terminates the Contractor’s right to proceed, liquidated damages will continue to accrue until the work is completed. These liquidated damages are in addition to excess costs of repurchase under the Termination clause.

52.211-13 TIME EXTENSIONS (SEPT 2000)

Time extensions for contract changes will depend upon the extent, if any, by which the changes cause delay in the completion of the various elements of construction. The change order granting the time extension may provide that the contract completion date will be extended only for those specific elements related to the changed work and that the remaining contract completion dates for all other portions of the work will not be altered. The change order also may provide an equitable readjustment of liquidated damages under the new completion schedule.

PERFORMANCE OF WORK BY THE CONTRACTOR (APR 1984)

The Contractor shall perform on the site, and with its own organization, work equivalent to at least twenty (20) percent of the total amount of work to be performed under the contract. This percentage may be reduced by a supplemental agreement to this contract if, during performing the work, the Contractor requests a reduction and the Contracting Officer determines that the reduction would be to the advantage of the Government.

Physical Data (Apr 1984)

Data and information furnished or referred to below is for the Contractor’s information. The Government shall not be responsible for any interpretation of or conclusion drawn from the data or information by the Contractor.

(a) The indications of physical conditions on the drawings and in the specifications are the result of site investigations.

(b) Weather conditions: The Contractor shall make his own investigations as to weather conditions at the site. Data may be obtained from various National Weather Service offices located generally at airports of principal cities, the nearest to this project being Sault St Marie, MI.

(c) Transportation facilities: Roads and railroads in the general area are not shown on the drawings. Access ways shall be investigated by the Contractor to satisfy himself as to their existence and allowable use.

(d) Historical data for all areas may be obtained from:

U. S. Department of Commerce National Climatic Center Federal Building Asheville, N. C. 28801

Site Visit (Construction) (Feb 1995) Alternate I

(a) The clauses at 52.236-2, Differing Site Conditions, and 52.236-3, Site Investigations and Conditions Affecting the Work, will be included in any contract awarded as a result of this https://www.acquisition.gov/content/52236-2-differing-site-conditions#i1048797 https://www.acquisition.gov/content/52236-3-site-investigation-and-conditions-affecting-work#i1048811 solicitation. Accordingly, offerors or quoters are urged and expected to inspect the site where the work will be performed.

Coordinate with on-site PM, Marcy Werth via email (Marcy.J.Werth2@usace.army.mil) or by phone: (716) 359-1035 on the following:

Site Visit Information:

DATE: Thursday, 03 SEPT 2026 (Thursday)

TIME: 9:00 AM Local Time

LOCATION: Meet at Soo Locks Main Guard Gate on W. Portage Avenue, Sault Sainte Marie, Michigan.

POC: Eric Galer or Andrew Nelson

At least 2 working days prior to the site visit (01 SEPT), the following information must be submitted via email to Marcy.J.Werth2@usace.army.mil to facilitate entry access. If your information is received after the deadline, we will not be able to guarantee you site access. Anyone planning to attend the site visit must submit the following:

• For US citizens: Full name, date of birth, social security number, and their company name

• For Non-US Citizens: Full name, date of birth, passport number, and their company name

Due to ongoing active construction at the Soo Locks, PPE will be required by all attendees. Required PPE includes, at a minimum, hard hat, safety glasses, high visibility vest (Class II minimum), and hard toe boots/shoes. Some loaner PPE may be available, but attendees should plan to bring their own. NOTE: If any site visit attendee(s) would like to view the deep service tunnel, prior to being allowed access, they will need to show proof of fall protection training and confined space training.

(End of provision)

52.246-21 WARRANTY OF CONSTRUCTION (MAR 1994)

(a)In addition to any other warranties in this contract, the Contractor warrants, except as provided in paragraph (i) of this clause, that work performed under this contract conforms to the contract requirements and is free of any defect in equipment, material, or design furnished, or workmanship performed by the Contractor or any subcontractor or supplier at any tier.

(b)This warranty shall continue for a period of 1 year from the date of final acceptance of the work. If the Government takes possession of any part of the work before final acceptance, this warranty shall continue for a period of 1 year from the date the Government takes possession.

(c)The Contractor shall remedy at the Contractor’s expense any failure to conform, or any defect.

In addition, the Contractor shall remedy at the Contractor’s expense any damage to Government-owned or controlled real or personal property, when that damage is the result of-mailto:Marcy.J.Werth2@usace.army.mil

(1)The Contractor’s failure to conform to contract requirements; or

(2)Any defect of equipment, material, workmanship, or design furnished.

(d)The Contractor shall restore any work damaged in fulfilling the terms and conditions of this clause. The Contractor’s warranty with respect to work repaired or replaced will run for 1 year from the date of repair or replacement.

(e)The Contracting Officer shall notify the Contractor, in writing, within a reasonable time after the discovery of any failure, defect, or damage.

(f)If the Contractor fails to remedy any failure, defect, or damage within a reasonable time after receipt of notice, the Government shall have the right to replace, repair, or otherwise remedy the failure, defect, or damage at the Contractor’s expense.

(g)With respect to all warranties, express or implied, from subcontractors, manufacturers, or suppliers for work performed and materials furnished under this contract, the Contractor shall-

(1)Obtain all warranties that would be given in normal commercial practice;

(2)Require all warranties to be executed, in writing, for the benefit of the Government, if directed by the Contracting Officer; and

(3)Enforce all warranties for the benefit of the Government, if directed by the Contracting Officer.

(h)In the event the Contractor’s warranty under paragraph (b) of this clause has expired, the Government may bring suit at its expense to enforce a subcontractor’s, manufacturer’s, or supplier’s warranty.

(i)Unless a defect is caused by the negligence of the Contractor or subcontractor or supplier at any tier, the Contractor shall not be liable for the repair of any defects of material or design furnished by the Government nor for the repair of any damage that results from any defect in Government-furnished material or design.

(j)This warranty shall not limit the Government’s rights under the Inspection and Acceptance clause of this contract with respect to latent defects, gross mistakes, or fraud.

(End of clause)

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT

REPORTING (MAY 2024)

(a) Definitions. As used in this clause—

“Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

“Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information.

“Covered defense information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.

‘‘Operationally critical support’’ means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.

“Rapidly report” means within 72 hours of discovery of any cyber incident.

“Technical information” means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013 , Rights in Technical Data—Other Than Commercial Products and Commercial Services, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of an Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the clause 252.239-7010 , Cloud Computing Services, of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at https://csrc.nist.gov/publications/sp800) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)(A) The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017. For all contracts awarded prior to October 1, 2017, the Contractor shall notify https://www.acquisition.gov/dfars/252.227-7013-rights-technical-data%E2%80%94other-commercial-products-and-commercial-services.#DFARS_252.227-7013 https://www.acquisition.gov/dfars/252.239-7010-cloud-computing-services.#DFARS_252.239-7010 the DoD Chief Information Officer (CIO), via email at osd.dibcsia@mail.mil, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the DoD CIO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be nonapplicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

(C) If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/documents-templates/) and that the cloud service provider complies with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures, in addition to those identified in paragraphs (b)(1) and

(2) of this clause, may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., medical devices) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

(c) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall—

(i) Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support; and

(ii) Rapidly report cyber incidents to DoD at https://dibnet.dod.mil.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements at https://dibnet.dod.mil.

(3) Medium assurance certificate requirement. In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil/eca/.

(d) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DoD Cyber Crime Center (DC3) in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

(e) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

(f) Access to additional information or equipment necessary for forensic analysis. Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

(g) Cyber incident damage assessment activities. If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(h) DoD safeguarding and use of contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with paragraph (c). To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released.

(i) Use and release of contractor attributional/proprietary information not created by or for DoD. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for DoD is authorized to be released outside of DoD—

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes (including with Defense Industrial Base (DIB) participants in the program at 32 CFR part 236); or

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract that includes the clause at 252.204-7009 , Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

(j) Use and release of contractor attributional/proprietary information created by or for DoD. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for DoD (including the information submitted pursuant to paragraph (c) of this clause) is authorized to be used and released outside of DoD for purposes and activities authorized by paragraph (i) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such information.

(k) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(l) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(m) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to—

(i) Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause; and

(ii) Provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DoD as required in paragraph (c) of this clause.

https://www.acquisition.gov/dfars/252.204-7009-limitations-use-or-disclosure-third-party-contractor-reported-cyber-incident-information.#DFARS_252.204-7009

252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL

CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) Definitions. As used in this clause—

“Controlled unclassified information” means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

“Current” means—

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status—

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status—

(i) Not older than 1 year for Final Level 1 (Self), with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with—

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

“Cybersecurity Maturity Model Certification (CMMC) status” means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

“Cybersecurity Maturity Model Certification unique identifier (CMMC UID)” means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.

“Federal contract information (FCI)” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

“Plan of action and milestones” means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication 800-115 (32 CFR 170.21).

(b) Framework. The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor’s compliance with applicable information security protections (see 32 CFR part 170).

(c) Duplication. The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances when a reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) Requirements. The Contractor shall—

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: CMMC Level 2 (Self) for all information systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level requiredin paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current,an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis,an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) Reporting. The Contractor shall—

(1) Submit to the Contracting Officer—

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract; and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2)Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) Subcontracts. The Contractor shall—

(1) Insert the substance of this clause, including this paragraph ( f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products and commercial services, excluding commercially available off-the-shelf items , if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2)…