Solicitation - N0018926QL084.pdf

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30.

Solicitation/Contract Form Continuation

NAVSUP FLC Norfolk CEP 200 Floor Replacement

N0018926QL084

Continuation of Supplies or Services and Prices/Costs

Additional Information/Notes

Item Supplies/Service Quantity Unit Unit Price Amount

0001 Material

Pricing Arrangement: Firm Fixed Price

1 Lot

0002 Labor

Pricing Arrangement: Firm Fixed Price

1 Lot

Continuation of Description

Requirements CEP 200 requires replacement of two office spaces and one warehouse flooring.

Continuation of Packaging and Marking

Continuation of Inspection and Acceptance

Overall Contract Inspection/Acceptance Locations

Inspection and Acceptance Location

Both Destination Instructions: See Statement of Work (SOW) for Acceptance/inspection criteria.

DoDAAC: N50054 CountryCode: USA

MID ATLANTIC REG MAINT CTR

9727 AVIONICS LOOP BLDG LF-18, NORFOLK VA 23511-2124

NORFOLK, VA 23511-2124

UNITED STATES

CDR Jermaine Seals, Dept Head, MARMC (Code 500) Email: jermaine.l.seals.mil@us.navy.mil Telephone: (757) 400-0500

Inspection and Acceptance Location

Both Destination Instructions: See Statement of Work (SOW) for Acceptance/inspection criteria.

DoDAAC: N50054 CountryCode: USA

MID ATLANTIC REG MAINT CTR

9727 AVIONICS LOOP BLDG LF-18, NORFOLK VA 23511-2124

NORFOLK, VA 23511-2124

UNITED STATES

CDR Jermaine Seals, Dept Head, MARMC (Code 500) Email: jermaine.l.seals.mil@us.navy.mil Telephone: (757) 400-0500

Continuation of Deliveries or Performance Title: CEP-200 Office and Warehouse Flooring Installation Desired Completion Date: 30 days after award date

STATEMENT OF WORK

Project Description and Purpose: Contractor shall provide all labor, materials, equipment, and management to replace flooring material in two offices and warehouse areas (see attachment 1) at 9170 2nd St, Norfolk VA, 23511. The Contractor shall ensure proper operational status upon completion of task.

Notes: N/A Attachments: CEP-200 Measurements Contract Deliverables:

1. Submit a detailed schedule of work.

2. Ensure that surrounding surfaces are protected from damage throughout the duration of the task.

3.The Contractor shall maintain all flooring and work areas in a condition that passes a daily site inspection, defined as: no tools or materials left unattended in walkways, all scrap and debris removed to a designated waste area, and all pathways maintaining a minimum 36-inch clear width at all times.

4. For office work:

a. contractor is to remove existing carpet and associated adhesive and dispose of properly off federal installation.

b. Contractor is to prepare surface for proper adhesion IAW ICRI guidelines.

c. Apply epoxy base coat at 15 mils thickness, Polymer Flake Nightfall FB-715 at 1/8inch flake thickness and apply topcoat.

d. Install 4" Roppe vinyl baseboards in black.

5. For warehouse work:

a. contractor shall remove existing coatings and prepare surface IAW manufacturer specifications.

b. Apply moisture barrier primer at approximately 20 mils thickness.

c. Apply epoxy base coat at 5-10 mils thickness, Polymer Flake Nightfall FB-715 at 1/8inch flake thickness and apply topcoat.

d. Install a yellow border for designated forklift charging stations at current size.

e. Install 4" Roppe vinyl baseboards in black.

6. Contractor is to remove any chemicals and dispose of them off federal instillation in accordance with City, State and or Federal regulations.

7. Perform a worksite cleanup and properly dispose of all debris associated with the task.

Working Hours: The Contractor shall accomplish work within working hours of 0700-1500.

Installation Address: Installation shall be completed at Naval Station Norfolk, Bldg. CEP-200, 9170 2nd St, Norfolk, VA 23511. The room numbers are 151A, 151D, 152, and attached warehouse spaces.

Pre-Proposal Meeting: A pre-proposal site meeting shall be held if requested by the Contractor prior to the award of this task order. The contractor shall coordinate the date and time with the Contracting Officer.

Pre-Performance Meeting: No work will start prior to the Pre-performance meeting with the Government Designated Authority and customer. The purpose of the meeting is for the contractor and government to obtain a mutual understanding of the existing conditions, the tasks required to complete the work, specific impacts and risks associated with the work and cover all documentation requirements.

Hazardous Material Disclosure: For work in soil excavation and other exterior construction etc., the Contractor may be required to work with contaminated material involving abatement or management of these contaminated materials. However, if during the performance of the work, the Contractor encounters hazardous substances not known prior to issuance of this Task Order; the Contractor shall immediately stop work and inform the Contracting Officer for direction. In no instance shall the Contractor perform the work involving the hazardous material without notifying and receiving approval from the Contracting Officer for direction.

Document and Repair Schedule: The Contractor shall provide to the Government Designated Authority (GDA) a list of all personnel who will be working on site, Activity Hazard Analysis (AHA), schedule of work and any outage paperwork at the Pre-performance meeting. All work shall be performed in accordance with current standard industry practices, applicable local, state and federal codes, laws and regulations, Unified Facilities Criteria (UFC's), Unified Facilities Guide Specifications (UFGS), US Army Corps of Engineers (EM 385) all OSHA safety regulations, EPA guidelines and base procedures. All work shall comply with the Uniform Federal Accessibility Standards (UFAS) and Americans with Disabilities Act Accessibility Guide (ADAAG). All work including subcontracted work shall comply with base procedures, latest revision of the NNSY specific guide specifications for environmental and safety requirements, state and federal regulations.

Line Item Delivery Schedule Quantity Address and POC

Period of Performance From 04 May 2026 To 05 Jun 2026

1 Lot Place of Performance DoDAAC: N50054 CountryCode: USA

MID ATLANTIC REG MAINT CTR

9727 AVIONICS LOOP BLDG LF-18, NORFOLK VA 23511-2124

NORFOLK, VA 23511-2124

UNITED STATES

CDR Jermaine Seals, Dept Head, MARMC (Code 500) Email: jermaine.l.seals.mil@us.navy.mil Telephone: (757) 400-0500

Period of Performance From 04 May 2026 To 05 Jun 2026

1 Lot Place of Performance DoDAAC: N50054 CountryCode: USA

MID ATLANTIC REG MAINT CTR

9727 AVIONICS LOOP BLDG LF-18, NORFOLK VA 23511-2124

NORFOLK, VA 23511-2124

UNITED STATES

CDR Jermaine Seals, Dept Head, MARMC (Code 500) Email: jermaine.l.seals.mil@us.navy.mil Telephone: (757) 400-0500

Continuation of Accounting and Appropriation Data

Contract Clauses

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements. Jan 2017 52.204-13 System for Award Management-Maintenance. (Deviation 2026-O0038) Feb 2026 52.219-6 Notice of Total Small Business Set-Aside. (Deviation 2026-O0038) Feb 2026 52.222-41 Service Contract Labor Standards. (Deviation 2026-O0038) Feb 2026 52.222-62 Paid Sick Leave Under Executive Order 13706. (Deviation 2026-O0038) Feb 2026 52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving. May 2024 52.232-33 Payment by Electronic Funds Transfer-System for Award Management. Oct 2018 52.232-40 Providing Accelerated Payments to Small Business Subcontractors. Mar 2023 52.233-3 Protest after Award. (Deviation 2026-O0038) Feb 2026 52.233-4 Applicable Law for Breach of Contract Claim. (Deviation 2026-O0038) Feb 2026

52.212-4 Terms and Conditions-Commercial Products and Commercial Services. (Deviation 2026- O0038)

Feb 2026

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards. (Deviation 2026- O0038)

Feb 2026

52.209-6 Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded. (Deviation 2026-O0038)

Feb 2026

52.222-36 Equal Opportunity for Workers with Disabilities. (Deviation 2026-O0038) Feb 2026 52.222-54 Employment Eligibility Verification. (Deviation 2026-O0038) Feb 2026

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.203-7000 Requirements Relating to Compensation of Former DoD Officials. Sep 2011 252.203-7002 Requirement to Inform Employees of Whistleblower Rights. Dec 2022 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. May 2024

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

Jan 2023

252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime. Jan 2023 252.232-7003 Electronic Submission of Payment Requests and Receiving Reports. Dec 2018 252.232-7010 Levies on Contract Payments. Dec 2006 252.247-7023 Transportation of Supplies by Sea. Oct 2024 252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support. Jan 2023 252.204-7020 NIST SP 800-171 DoD Assessment Requirements. Nov 2023 252.244-7000 Subcontracts for Commercial Products or Commercial Services. Nov 2023 252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region. Jun 2023

FAR Clauses Incorporated by Full Text

52.219-4 Notice of Price Evaluation Preference for HUBZone Small Business Concerns. (Deviation 2026-O0038)

(Feb 2026)

NOTICE OF PRICE EVALUATION PREFERENCE FOR HUBZONE SMALL BUSINESS CONCERNS (FEB 2026) (DEVIATION 2026- O0038)

Evaluation preference.(a)

Offers will be evaluated by adding a factor of 10 percent to the price of all offers, except-(1)

(i) Offers from HUBZone small business concerns that have not waived the evaluation preference; and

(ii) Otherwise successful offers from small business concerns.

(b) . A HUBZone small business concern may choose to waive the evaluation preference. If the concern waives Waiver of evaluation preference the preference, the factor will be added to its offer for evaluation purposes.

Offeror chooses to waive the evaluation preference.

(c) A HUBZone joint venture agrees that, in the performance of the contract, at least 40 percent of the aggregate work performed by Joint venture.

the joint venture shall be completed by the HUBZone small business parties to the joint venture. Work performed by the HUBZone small business parties to the joint venture must be more than administrative functions.

(End of provision)

52.222-42 Statement of Equivalent Rates for Federal Hires. (May 2014)

STATEMENT OF EQUIVALENT RATES FOR FEDERAL HIRES (MAY 2014)

In compliance with the Service Contract Labor Standards statute and the regulations of the Secretary of Labor ( ), this clause 29 CFR Part 4 identifies the classes of service employees expected to be employed under the contract and states the wages and fringe benefits payable to each if they were employed by the contracting agency subject to the provisions of 5 U.S.C.5341 or 5332.

This Statement is for Information Only: It is not a Wage Determination

Employee Class Monetary Wage-Fringe Benefits

Flooring Installer $68.90

(End of clause)

DFARS Clauses Incorporated by Full Text

252.232-7006 Wide Area WorkFlow Payment Instructions. (Jan 2023)

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause- Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as Electronic invoicing.

authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall- WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice WAWF training.

Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web entry, Electronic Data Interchange, or File Transfer WAWF methods of document submission.

Protocol.

(f) The Contractor shall use the following information when submitting payment requests and receiving reports WAWF payment instructions.

in WAWF for this contract or task or delivery order:

(1) The Contractor shall submit payment requests using the following document type(s): Document type.

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(Contracting Officer: Insert either "Invoice 2in1" or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF "combo" document type to create some combinations of invoice and receiving report in one step.]

(3) The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in Document routing.

WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC ____

Issue By DoDAAC ____

Admin DoDAAC ____

Inspect By DoDAAC ____

Ship To Code ____

Ship From Code ____

Mark For Code ____

Service Approver (DoDAAC) ____

Service Acceptor (DoDAAC) ____

Accept at Other DoDAAC ____

LPO DoDAAC ____

DCAA Auditor DoDAAC ____

Other DoDAAC(s) ____

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert "See Schedule" or "Not applicable.")

(**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in Payment request.

accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F. Receiving report.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

(Contracting Officer: Insert applicable information or "Not applicable.")

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements.

(Nov 2025)

CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)

(a) . As used in this clause- Definitions

"Controlled unclassified information" means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h)).

"Current" means-

(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status-

(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR

170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and

(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance by an affirming official;

(2) With regard to Final CMMC Status-

(i) Not older than 1 year for Final Level 1 (Self), with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;

(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with-

(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and

(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and

(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170.

"Cybersecurity Maturity Model Certification (CMMC) status" means the result of meeting or exceeding the minimum required score for the corresponding assessment. The potential statuses are as follows:

(1) Final Level 1 (Self).

(2) Conditional Level 2 (Self).

(3) Final Level 2 (Self).

(4) Conditional Level 2 (C3PAO).

(5) Final Level 2 (C3PAO).

(6) Conditional Level 3 (DIBCAC).

(7) Final Level 3 (DIBCAC).

"Cybersecurity Maturity Model Certification unique identifier (CMMC UID)" means 10 alpha-numeric characters assigned to each CMMC assessment and reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.

"Federal contract information (FCI)" means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public websites, or simple transactional information, such as information necessary to process payments.

"Plan of action and milestones" means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special Publication 800-115 (32 CFR 170.21).

(b) . The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's compliance with Framework applicable information security protections (see 32 CFR part 170).

(c) . The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances Duplication when a reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.

(d) . The Contractor shall- Requirements

(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: ____ for all information Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC) systems used in performance of the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and

(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments;

(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required in paragraph (d)(1) of this clause, or higher;

(3) Complete on an annual basis, and maintain as current, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) ( ) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI https://piee.eb.mil or CUI and that are used in performance of the contract;

(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract; and

(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(e) . The Contractor shall- Reporting

(1) Submit to the Contracting Officer-

(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the contract; and

(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;

(2) Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and

(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.

(f) . The Contractor shall- Subcontracts

(1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products or commercial services, excluding commercially available off-the-shelf items, if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and

(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.

(End of clause)

Addendum to 52.212-4, Contract Terms and Conditions - Commercial Products and Commercial Services

Contract Terms and Conditions Required To Implement Statutes or Executive Orders — Commercial Products and Commercial Services

Addendum to Contract Clauses

Contract Clauses

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations. (Deviation 2026- O0038)

Feb 2026

52.240-91 Security Prohibitions and Exclusions. (Deviation 2026-O0038) Feb 2026

52.244-6 Subcontracts for Commercial Products and Commercial Services. (Deviation 2026- O0038)

Feb 2026

52.223-5 Pollution Prevention and Right-to-Know Information. May 2024 52.232-39 Unenforceability of Unauthorized Obligations. Jun 2013 52.237-2 Protection of Government Buildings, Equipment, and Vegetation. Apr 1984 52.222-3 Convict Labor. (Deviation 2026-O0038) Feb 2026

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.237-7010 Prohibition on Interrogation of Detainees by Contractor Personnel. Jan 2023 252.219-7003 Small Business Subcontracting Plan (DoD Contracts). Dec 2019 252.204-7003 Control of Government Personnel Work Product. Apr 1992 252.223-7006 Prohibition on Storage, Treatment, and Disposal of Toxic or Hazardous Materials. Sep 2014 252.225-7048 Export-Controlled Items. Jun 2013

FAR Clauses Incorporated by Full Text

52.252-6 Authorized Deviations in Clauses. (Nov 2020)

AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any [insert regulation name] (48 CFR ) clause with an authorized deviation is DFARS Chapter 2 indicated by the addition of "(DEVIATION)" after the name of the regulation.

(End of clause)

52.252-2 Clauses Incorporated by Reference. (Feb 1998)

CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far/part-52 [Insert one orhttps://www.acquisition.gov/dfars/part-252-solicitation-provisions-and-contract-clauses ____ more Internet addresses]

(End of clause)

Additional Regulation or Supplemental Clauses Incorporated by Full Text

243-9400(1-92) SUPTXT243-9400(1-92) AUTHORIZED CHANGES ONLY BY THE

CONTRACTING OFFICER

(Jan 2024)

AUTHORIZED CHANGES ONLY BY THE CONTRACTING OFFICER

(a) Except as specified in paragraph (b) below, no order, statement, or conduct of Government personnel who visit the Contractor's facilities or in any other manner communicate with Contractor personnel during the performance of this contract shall constitute a change under the "Changes" clause of this contract.

(b) The Contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer, or is pursuant to specific authority otherwise included as a part of this contract.

(c) The Contracting Officer is the only person authorized to approve changes in any of the requirements of this contract and notwithstanding provisions contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. In the event the Contractor effects any change at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in charges incurred as a result thereof. The address and telephone number of the Contracting Officer is: TBD

NAME:

ADDRESS:

TELEPHONE:

204-9400(05-24)

SUPTXT204-9400(05-24) CONTRACTOR UNCLASSIFIED ACCESS TO

FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION,

INFORMATION TECHNOLOGY (IT) SYSTEMS OR PROTECTED HEALTH

INFORMATION

(Jan 2024)

(a) Insert the following, as applicable, in full text in all solicitations and contracts (including commercial acquisitions) Statement of Work (SOW) or Performance Work Statement (PWS) under the Schedule of Supplies/Services.

To submit recommended contract language to be incorporated into the Naval Supply Systems Command (NAVSUP) Contracts Handbook (CH) as NAVSUP component text, the language must not meet the requirements for a regulation clarification or change. All submissions (utilizing the text template on Contracting Knowledge Site (CKS)) should be reviewed and approved by the activity's Chief of the Contracting Office (CCO) prior to submission.

(1) SUPTXT204-9400 (05-24) Prescription and Alternative Language

The following shall be inserted in full text in all solicitations and contracts (including commercial acquisitions) which require contractor unclassified access to federally controlled facilities, sensitive information, Information Technology (IT) systems or protected health information. For commercial acquisitions, this text shall be incorporated into either the SOW or PWS.

* Consult with your CSM and ISSM/IAM for local policy when Authorized User (non-sensitive) access is required for non-U.S. citizens outside the U.

S.

** Alternative language which may be included as appropriate:

Contractor and all Contractor employees with access to or responsibility for XXXXXX of this contract shall comply with DoD Directive 8500.1E IA, DoDI 8510.01 Risk Management Framework (RMF) for DoD IT, DoD Directive 5400.11 DoD Privacy Program, DoD 5200.2-R Personnel Security Program and HSPD 12

X.1 Be CAC ready at the properly designated IT System Level

X.2 At minimum, all contractor employees must possess/maintain the required background investigation as determined by the PDT and/or IT access user level. This requirement is critical in order to access the government data base systems It is the contractor's responsibility to ensure that 100% of the contractor employees have the ability to acquire a favorably adjudicated background investigation. In addition, interim approval of clearances is not authorized.

X.3 Be citizens of the U.S

X.4 If at any time, any contractor employee requiring a Common Access Card (CAC) is unable to possess/maintain the required adjudicated background investigation, the contractor shall immediately notify the NAVSUP COR to coordinate removal of such a person from work under this contract.

X.5 Contractor employees with access to or responsibility for nonpublic government data under this contract must comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the CAC.

(1) SUPTXT204-9400(4-22) CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE

INFORMATION, INFORMATION TECHNOLOGY (IT) SYSTEMS OR PROTECTED HEALTH INFORMATION

The security text does not apply in cases where the contractor/vendor does not have access to Navy Marine Corps Intranet (NMCI) computers, is not issued a Common Access Card (CAC) and is involved in training or other short term duties of less than 30 days duration that allow for the use of a visitor request. In these cases, the government employee must submit a Visitor Access Request (VAR) to the main gate or applicable processing entity for your facility and assume responsibility to escort those without CAC Credentials.

This local text does not apply to non-United States (U.S.) Nationals (foreign nationals) who are contactor employees performing work overseas. This text is applicable to the U.S. Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, IT

SYSTEMS OR PROTECTED HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC. Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department, or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete "Level I Antiterrorism Awareness Training" prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol. 1. In accordance with Department of Defense Instruction O-2000.16 Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of "Level I Antiterrorism Awareness Training" available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism Awareness instructor; or

3. By providing a training certificate for "Level I Antiterrorism Awareness Training" training showing completion within the last calendar year.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, "DoD Operations Security (OPSEC) Program," June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete "OPSEC Awareness for Military Members, DoD Employees and Contractor" training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.usalearning.gov/opsec/index.

htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. OF-306 signed by contractor employee

b. FD-258 Fingerprint Card (Contingent upon availability of electronic fingerprinting submission)

c. Completed Electronic Investigation (e-QIP)

d. All contractor employees with need for a Common Access Card (CAC) must have an active Defense Information System for Security (DISS) profile.

e. Common Access Card (CAC)

f. DISS Visit Request submitted (Contingent upon classification of work being performed, Confidential, Secret, Top Secret).

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In accordance with DON CIO Memorandum (IT LEVEL DESIGNATION ON DD FORM 2875 SYSTEM AUTHORIZATION ACCESS REQUEST) 08 September 2020, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as Privileged, Enhanced, or Authorized users. All user level accesses may include positions which require access to Controlled Unclassified Information (CUI). CUI includes sensitive information protected under the Privacy Act, to include Protected Health Information (PHI). IT System levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged access, (when specified by the terms of the contract) require a Tier 5 (T5) or T5R equivalent investigation, which is a higher level investigation than the Tier 3 (T3) and T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Contractors requiring Enhanced access, (when specified by the terms of the contract) require a T3, T3R, or equivalent investigation, which is a higher level investigation than the Tier 1 (T1) described below. Due to the enhanced system access, an investigation suitable for Moderate Risk national security positions is required.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N;

therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the supervisor.

The SAAR-N shall be forwarded to the CSM upon contractor employee acquiring a Common Access Card (CAC) credential. Failure to obtain a CAC credential may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all contractor employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense's operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information (CUI). CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP's ability to conduct its mission. Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with DoDI 5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training.

a. Whenever Government provides CUI to, or CUI is generated by, non-DoD entities, all CUI records must be handled as required by the approved mandatory disposition authority.

b. All CUI records must follow the approved mandatory disposition authority whenever the Government provides CUI to, or CUI is generated by, non- DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and the DoDI 5200.48.

c. Contractor employees shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information

d. Contractor employees shall submit unclassified government information for review and approval for release in accordance with the Standard DoD Component Processes, DoDI 5230.09, and DoDM 5205.07, Volume 1.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO

NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. If the Security Office validates the contractor's position is Non-Critical Sensitive or if the IT system user level is determined to be Enhanced, at a minimum, each contractor employee must be a US citizen and have a favorably completed T3, T3R, or equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or Enhanced position. The investigation consists of a standard National Agency Check and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or Enhanced position is required to complete:

SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

Two FD-258 Applicant Fingerprint Cards or electronic fingerprint submission (preferred))

Original Signed Release Statements

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) five (5) years) throughout the contract performance period.