Vendor Questions and Government Responses.pdf

Prospective Vendor Questions & Government Responses

Commercial Mass Text Messaging Subscription Service Solicitation: W9115126QA017

1. CUI Designation

Question: Will the contractor (or any subcontractor) be required to process, store, or transmit Controlled Unclassified Information (CUI) under this requirement? If so, will CUI be explicitly marked and identified as such?

Answer: Yes. The contractor will be required to process, store, and transmit Controlled Unclassified Information (CUI) as a core function of this requirement.

The primary form of CUI involved will be Personally Identifiable Information (PII), including but not limited to:

• Contact lists containing names and phone numbers of soldiers and family members

• Message content that may include names or other identifying information

The contractor’s platform will:

• Store CUI in contact lists and message logs

• Process CUI during message creation, scheduling, and management

• Transmit CUI over telecommunications carrier networks

Because CUI is handled throughout performance, the contractor must comply with DFARS 252.204-7012, which requires implementation of NIST SP 800-171 security controls for protecting CUI in non-federal systems.

2. CMMC Level Requirement

Question: Does this requirement mandate a specific CMMC level for performance?

Answer: Yes. This requirement will mandate CMMC Level 2 (Advanced).

Rationale:

• The contractor will handle Controlled Unclassified Information (CUI).

• Under the DoD Cybersecurity Maturity Model Certification (CMMC) program, contractors handling CUI must meet CMMC Level 2.

• CMMC Level 2 aligns with the 110 controls of NIST SP 800-171, which are required under DFARS 252.204-7012.

Offerors must demonstrate the ability to comply with NIST SP 800-171, and the resulting contract will include clauses requiring achievement of CMMC Level 2 once fully implemented across DoD contracts.

3. CMMC Flow-Down to Subcontractors

Question: If CMMC Level 2 is required, does the requirement flow down to subcontractors who may host or transmit data in support of the platform?

Answer: Yes. CMMC Level 2 requirements flow down to all subcontractors that process, store, or transmit CUI.

Key points:

• The requirement follows the data, not the organizational role.

• Any subcontractor whose systems “touch” CUI must meet CMMC Level 2.

• The prime contractor is responsible for ensuring supply-chain compliance.

Examples:

• If the SaaS provider uses a third-party cloud hosting service (e.g., AWS GovCloud, Azure Government), that environment must meet applicable compliance requirements.

• If an SMS aggregator or telecommunications intermediary handles CUI, that entity must also meet CMMC Level 2.

The prime contractor must validate and ensure compliance across all subcontractors involved in handling Government CUI.

4. Information Type Classification

Question: For planning purposes, would the information transmitted via the messaging platform be considered Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or other?

Answer: The information transmitted and stored via the messaging platform will be considered both Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

5. DFARS Clause Applicability

Question: We note that DFARS 252.204-7012 and related safeguarding clauses may apply.

Could you please confirm whether those clauses are intended to require CUI handling controls for this effort?

Answer: Yes. The inclusion of DFARS 252.204-7012 and related clauses is intentional and requires the contractor to implement, maintain, and certify appropriate CUI safeguarding controls.

Because the service involves storing and transmitting CUI (specifically PII within contact lists), compliance with NIST SP 800-171 is a mandatory performance requirement.

Offerors should prepare proposals and pricing with the understanding that full compliance with these cybersecurity requirements is required.

Question: It is our understanding that the Family Readiness Group (FRG) text message service requires FedRAMP certification because the communication involves Personally Identifiable Information (PII), the platform must meet security requirements equivalent to FedRAMP Moderate. The Combined Synopsis/Solicitation paragraph 1.24.5 Personally Identifiable Information (PII): specifies PII is involved. Please clarify whether the Government intended to include a FedRAMP Moderate authorization requirement in this solicitation?

Answer: No, the Government did not intend to include a specific FedRAMP Moderate authorization requirement in this solicitation. The security requirements for this contract are defined by the DFARS 252.204-7012 clause, which mandates compliance with NIST SP 800-171 and alignment with CMMC Level 2, not FedRAMP.