Amendment 0002 - Attachment C.pdf

This document is a DFARS clause establishing Cybersecurity Maturity Model Certification (CMMC) level requirements for contractors under solicitation SPE603-26-R-0529, Amendment 0002.

The solicitation requires contractors to achieve and maintain CMMC Level 1 (Self) certification prior to contract award. Contractors must demonstrate current CMMC status in the Supplier Performance Risk System (SPRS) at https://piee.eb.mil and provide affirmation of continuous compliance with security requirements under 32 CFR Part 170. All contractor information systems that will process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) during contract performance must comply with this requirement. Offerors who fail to meet these CMMC Level 1 requirements for each applicable information system are ineligible for contract award. If an offeror holds CMMC Conditional status, they must successfully complete a valid plan of action and milestones per 32 CFR 170.21 to achieve Final status. Offerors must provide in their proposals the CMMC unique identifiers (CMMC UIDs) issued by SPRS for each contractor information system processing FCI or CUI, and must update this list when new CMMC UIDs are generated following self-assessment results entry into SPRS.