Attachment 0011 Industry Questions and U.S. Government Answers 14MAY2026 1.docx

Industry Questions and U.S. Government Answers Attachment 0011 14 May 2026

Q1. Section L.3.12.c. of the Reference (a) solicitation requires that other than small businesses submit a Small Business Subcontracting Plan with their proposals. Upon review of the Industry Question and Answer document (Attachment 0010), Q7 and A7, KTR respectfully requests clarification as to whether a separate Small Business Subcontracting Plan is to be submitted along with the proposal. If so, please confirm the Small Business Subcontracting Plan does not count towards the 10-page maximum for Volume 4 under Par. L.2.2.a.4. For reference, Small Business Participation Attachment 0005, which must be included in Volume 4, is three (3) pages, leaving only seven (7) pages for the remainder of Volume 4. In our experience, Small Business Subcontracting Plans are typically 13-15 pages by themselves.

A1. The Government’s position on the Volume 4 formatting is as follows:

Small Business Subcontracting Plan (SBSCP): Other than small businesses are required to submit a separate SBSCP in accordance with Section L.3.12.c.

Page Count Clarification: The SBSCP is excluded from the 10-page maximum for Volume 4. Attachment 0005 (Small Business Participation) remains subject to the 10-page limit.

Solicitation Amendment: This exclusion is formally reflected in this amendment to Solicitation W519TC-26-R-0007.

Q2. KTR has solicited current CMMC 2.0 Level 2 readiness status from its relevant supply base. Based on the responses received, KTR does not believe the current supply base can uniformly achieve CMMC Level 2 self-assessment with senior official affirmation by 10 November 2026. Based on solicited feedback, suppliers are (a) still evaluating applicability, (b) remain at Level 1, (c) are working towards Level 2 later in the year, or (d) have indicated they do not intend to comply. Given the supply base reality, will the Government consider revising the requirement to allow a documented, risk-based transition approach, under which the KTR would include alternatively acceptable sub-tier CMCC compliance milestones in the IMS and require affected suppliers to demonstrate adequate progress through an SSP, SPRS submission, or POA&M? Alternatively, please confirm whether the 10 November 2026 Level 2 self-assessment requirement applies only to suppliers that will process, store, or transmit CUI/FCI in performance of the contract, and whether suppliers that do not receive or handle CUI/FCI may continue supporting performance subject to appropriate flowdowns, access controls, and cybersecurity representations.

A2. The CMMC Program allows limited use of Plans of Action and Milestones (POA&Ms). Refer to §170.21 of the 32 CFR CMMC Program final rule for POA&M requirements, including critical requirements that cannot be included in a POA&M. A POA&M closeout assessment is a CMMC assessment that evaluates only the NOT MET requirements identified in the initial assessment. The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out within this timeframe, the Conditional CMMC Status for the information system will expire. The POA&M closeout self-assessment shall be performed by the OSA in the same manner as the initial self-assessment.

We agree with the interpretation that the Level 2 self-assessment requirement applies only to suppliers that will process, store, or transmit CUI/FCI in performance of the contract. Suppliers that do not receive or handle CUI/FCI may continue supporting performance subject to appropriate flow downs, access controls, and cybersecurity representations.