Questions from Offerors 20 AUG 2026.docx

SOURCE SELECTION INFORMATION FAR 2.101 and 3.104 Questions from Offerors:

1. Are CMMC requirements required of subcontractors? Per DFARS 252.204-7021(d)(1) (ii) prime contractors are to Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments Per DFARS 252.204-7021(d)(4) Prime contractors are to Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract Per CFR 107.23 Application to subcontractors (a) CMMC requirements apply to prime contractors and subcontractors throughout the supply chain at all tiers that will process, store, or transmit any FCI or CUI on contractor information systems in the performance of the DoD contract or subcontract. Prime contractors shall comply and shall require subcontractors to comply with and to flow down CMMC requirements, such that compliance will be required throughout the supply chain at all tiers with the applicable CMMC level and assessment type for each subcontract as follows:

(1) If a subcontractor will only process, store, or transmit FCI (and not CUI) in performance of the subcontract, then a CMMC Status of Level 1 (Self) is required for the subcontractor.

(2) If a subcontractor will process, store, or transmit CUI in performance of the subcontract, then a CMMC Status of Level 2 (Self) is the minimum requirement for the subcontractor.

(3) If a subcontractor will process, store, or transmit CUI in performance of the subcontract and the associated prime contract has a requirement for a CMMC Status of Level 2 (C3PAO), then the CMMC Status of Level 2 (C3PAO) is the minimum requirement for the subcontractor.

(4) If a subcontractor will process, store, or transmit CUI in performance of the subcontract and the associated prime contract has a requirement for the CMMC Status of Level 3 (DIBCAC), then the CMMC Status of Level 2 (C3PAO) is the minimum requirement for the subcontractor.

2. Can the Government First Article Test Requirements be waived? Yes. Information regarding First Article Test Requirements waivers are provided on Block 11 of the Form 260 attachment to the RFP. In accordance with Block 11, paragraph c., offerors who have previously furnished production quantities of the same or similar articles to the Air Force, provided articles thus furnished, have exhibited satisfactory performance in the opinion of the Air Force; provided not more than 36 months have elapsed since completion of the contract. Under conditions stated in paragraph c., the cognizant engineering activity will decide whether or not the item has exhibited satisfactory performance in service and prepare and retain supporting documentation to fully justify this decision. The following information must be provided for the previously supplied article: Procuring Office, Contract Number, Date of Contract, and Specification Number and Revision.

3. If the First Article Test requirements are waived, will the applicable CDRLs be removed? Yes. Any CDRL applicable to First Article requirements will be removed for offerors who qualify for GFAT waiver.

PREVIOUSLY PUBLISHED CLARIFICATIONS/QUESTIONS:

Below is the clarification regarding the Cybersecurity Maturity Model Certification (CMMC) requirements for the upcoming solicitation, based on current Department of Defense (DoD) acquisition regulations:

Required CMMC Level CMMC Level 2 is required because this effort involves ITAR-controlled technical data and Controlled Unclassified Information (CUI).

Timing of Compliance-Pre-Award Requirement. While an active assessment is not required at the exact moment of the proposal submission, the selected awardee must have the required level active and verified in the Supplier Performance Risk System (SPRS) at the time of contract award. The Contracting Officer cannot legally execute the award without this active status.

Subcontractor Flowdown - This pre-award certification requirement flows down to all subcontractors who will be handling CUI under this contract.

Below is a clarification regarding SAR Package Approvals:

20mm Mechanical Housing is classified as a Critical Application Item CAI, therefore, Source Approval Request SAR remains valid for 7 years from the date of the approval letter.