Amendment 0002 - Attachment B.pdf

This is a federal contracting clause establishing Cybersecurity Maturity Model Certification (CMMC) compliance requirements under DFARS 252.204-7021 (Deviation 2026-O0025 Rev 2, November 2025) for contract SPE603-26-R-0529, Amendment 0002.

The clause mandates that contractors maintain CMMC Level 1 (Self) certification status for all information systems used to process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). "Current" CMMC status is defined with specific timeframes: Conditional Level 2 assessments must not exceed 180 days old, Conditional Level 3 (DIBCAC) assessments must not exceed 180 days old, Final Level 1 assessments must not exceed one year old, Final Level 2 assessments must not exceed three years old, and Final Level 3 assessments must not exceed three years old. All CMMC status designations require affirmations of continuous compliance by an affirming official with no changes in compliance since the status date. Contractors must flow down CMMC requirements to subcontractors and other contractual instruments that process FCI or CUI, excluding commercially available off-the-shelf items. The contractor must submit CMMC Unique Identifiers (UIDs) to the contracting officer, enter assessment results into the Supplier Performance Risk System (SPRS), and maintain annual affirmations of continuous compliance. If a contractor achieves Conditional status, they must successfully close out a plan of action and milestones to achieve Final status. The clause applies throughout contract performance and prohibits duplicative assessments except in rare circumstances involving cybersecurity or compliance concerns.