AMD 3-EIE439-21 MAY 2025.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

PROJECT BY TITLE/LOCATION: EIE439 FUELS MANAGEMENT AND LABORATORY FACILITY

1.. This amendment provides changes to the solicitation as inidcated on the continuation pages of this document.

2. THE PROPOSAL DUE DATE HAS NOT BEEN EXTENDED

3. Proposals shall be submitted in accordance w ith Section 00 21 00, Para 1.12, Proposal Submittals

3. You are required to acknow ledge receipt of this amendment on the reverse side of the standard form 1442.

All other terms and conditions outlined in the Solictiation remain the same.

POC for this Amendment is MAJ Raven S. Donelson, 907-753-5611

1. CONTRACT ID CODE PAGE OF PAGES

J 1 3

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 21-May-2025

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street , County, State and Zip Code) X W911KB25R0020

X 9B. DATED (SEE ITEM 11)

21-Apr-2025

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

21-May-2025

CODE

U.S. ARMY ENGINEER DISTRICT, AK

CEPOA-CT (W911KB)

2204 TALLEY AVENUE

JBER AK 99506-0898

W911KB 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

W911KB25R0020

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION 00 11 00 - STANDARD FORM (SF) 1442

The following have been added by full text:

AMD 3

Amendment #3

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

a. The following drawings are substituted for the superseded documents/sections:

- Revised sheet FA-101 showing exterior wall provided (inquiry #11331251)

- Revised sheet A-502 provided (inquiry #11331251)

- Revised sheet S-501 provided (inquiry #11341251)

- Revised sheet M-601 updating Mechanical Heat Exchanger Schedule provided (no inquiry)

b. The following drawings are deleted:

- Deleted drawings H-001 and H-101 dated 10.17.24 (inquiry #11329095)

c. The following revised documents/sections are substituted for the superseded documents/sections. The identifier “AM#03” appears before and after new and/or revised materials, except as noted below.

- Revised Section 08 53 00, Fiberglass Windows removing paragraph 1.6.1.1. (inquiry #11340881)

- Section 10 11 00, Visual Display Units is newly added (inquiry #11340968)

NOTE: Revisions within the following documents do not contain the above referenced identifiers:

NONE

d. The following sections are deleted:

- Book 4- Design Analysis is deleted in its’ entirety

e. The following documents are added:

- EIE439 Geotechnical report provided. (inquiry #11336359)

- EIE439 Hazardous Materials Assessment provided. (inquiry #11338682)

f. The following revisions are incorporated:

NONE

g. Other:

- Eielson Repair POL OPS Building 100% drawings 2023.08.21 provided for reference. (inquiry

#11329112)

- B242 post-abatement photos from USACE provided for reference (inquiry #11340879)

- B242 post-abatement photos from abatement contractor provided for reference (inquiry #11340879)

- 23F0085 100110 Eielson Ops Building Drawings - For Construction R2 2023.12.04 provided for reference (inquiry #11340879)

- Entire Document: Wage Determination dated 15 May 2025

- NIST/CMMC Instructions

W911KB25R0020

(End of Summary of Changes)

ALL OTHER TERMS AND CONDITIONS SHALL REMAIN THE SAME.

(End of Summary of Changes)

SECTION 08 53 00

FIBERGLASS WINDOWS

08/20, CHG 1: 02/22

PART 1 GENERAL

1.1 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN ARCHITECTURAL MANUFACTURERS ASSOCIATION (AAMA)

AAMA 1503 (2009) Voluntary Test Method for Thermal

Transmittance and Condensation Resistance of Windows, Doors and Glazed Wall Sections

AAMA/WDMA/CSA 101/I.S.2/A440 (2017) North American Fenestration

Standard/Specification for Windows, Doors, and Skylights

AMERICAN SOCIETY OF HEATING, REFRIGERATING AND AIR-CONDITIONING

ENGINEERS (ASHRAE)

ASHRAE 169 (2013) Climate Data for Building Design

Standards

ASTM INTERNATIONAL (ASTM)

ASTM D3656/D3656M (2013) Standard Specification for Insect

Screening and Louver Cloth Woven from

Vinyl-Coated Glass Yarns

NATIONAL FENESTRATION RATING COUNCIL (NFRC)

NFRC 100 (2020) Procedure for Determining

Fenestration Product U-Factors

NFRC 200 (2020) Procedure for Determining

Fenestration Product Solar Heat Gain

Coefficient and Visible Transmittance at

Normal Incidence

U.S. DEPARTMENT OF DEFENSE (DOD)

UFC 4-010-01 (2018; with Change 2, 2022) DoD Minimum

Antiterrorism Standards for Buildings

U.S. DEPARTMENT OF ENERGY (DOE)

Energy Star (1992; R 2006) Energy Star Energy

Efficiency Labeling System (FEMP)

1.2 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. Submittals not having a "G" or "S" classification are for

Contractor Quality Control approval. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-02 Shop Drawings

Windows

Schedule of Windows

SD-03 Product Data

Windows

Fasteners

Hardware

Screens

Weatherstripping

Accessories

Adhesives

SD-04 Samples

Windows

SD-06 Test Reports

Windows

SD-10 Operation and Maintenance Data

Windows, Data Package 1

1.2.1 Shop Drawing Information

Indicate elevations of windows, full-size sections, thicknesses of PVC, reinforcing members, fastenings, proposed method of anchoring, size and spacing of anchors, details of construction, method of glazing, details of operating hardware, method and materials for weatherstripping, method of attaching screens, material and method of attaching subframes, casings, sills, accessories, installation details, window flashings and other related items.

Submit schedule of windows with drawings indicating location of each window unit.

1.2.2 Window Test Report Data

Submit for each window type attesting that identical or larger windows have been tested and meet the requirements specified herein for conformance to

AAMA/WDMA/CSA 101/I.S.2/A440 and the specified minimum Condensation

Resistance Factor (CRF).

1.3 QUALITY ASSURANCE

1.3.1 Labels

Each window unit must bear a certification label from an independent, nationally recognized testing organization validating that the product complies with AAMA/WDMA/CSA 101/I.S.2/A440 for the type, grade, and performance class specified.

1.3.2 Certification

Certified test reports attesting that the window units meet the requirements of AAMA/WDMA/CSA 101/I.S.2/A440 as specified will be acceptable in lieu of product labeling or marking.

1.4 DELIVERY, STORAGE, AND HANDLING

Deliver windows to the project site in an undamaged condition. Use care in handling and hoisting windows during transportation and at the job site.

Store windows and components out of contact with the ground, under a weathertight covering, to prevent bending, warping, or otherwise damaging the windows. Repair damaged windows to an "as new" condition as approved.

Provide new units if windows cannot be repaired.

1.5 PROTECTION

Protect finished surfaces during shipping and handling using the manufacturer's standard method, except do not apply coatings or lacquers on surfaces to receive caulking and glazing compounds.

1.6 WINDOW PERFORMANCE

Provide vinyl windows meeting the following performance requirements.

Perform testing requirements by an independent testing laboratory or agency.

1.6.1 Thermal Performance

Windows (including frames and glass) will be independently tested and certified with a Solar Heat Gain Coefficient (SHGC) determined according to

NFRC 200 procedures and a whole window U-factor determined in accordance with NFRC 100 within the ranges as indicated below according to the

ASHRAE 169 Climate Zone of the project location. Provide visual

Transmittance (VT) of 0.5 or greater.

AM#3...

1.6.1.1 Northern Climate

Windows installed within Climate Zone 8 will have a U-Factor of 0.20BTU/h ft

2.

degrees F or less. There is no SHGC limit for this climate zone.

...AM#3

1.6.1.1 Non-residential Windows

Non-residential glazed systems (including frames and glass) must be certified by the National Fenestration Rating Council with a whole-window

Solar Heat Gain Coefficient (SHGC) maximum of 0.27 for fixed windows determined according to NFRC 200 procedures and a U-factor maximum of 0.11 for fixed units Btu per square foot by ht by degree F in accordance with

NFRC 100.

PART 2 PRODUCTS

2.1 GENERAL REQUIREMENTS FOR WINDOWS

Provide windows conforming to AAMA/WDMA/CSA 101/I.S.2/A440 and to requirements specified herein. Provide windows of materials, types, grades, performance classes, combinations and sizes indicated or specified.

Provide each window as a unit consisting of frame, sash, glass, hardware, screen, weatherstripping, anchors and accessories complete. Design windows to accommodate glass, hardware, screens, weatherstripping, and accessories to be furnished. Provide factory or field installed glass. Provide windows with a minimum CRF of 72 when tested in accordance with AAMA 1503.

2.2 MATERIALS

2.2.1 Windows

Provide PVC, reinforcing members, fasteners, hardware, weatherstripping, and anchors conforming to AAMA/WDMA/CSA 101/I.S.2/A440 and as specified herein.

2.2.2 Glass and Glazing

As specified in Section 08 81 00 GLAZING.

2.2.3 Caulking and Sealing

As specified in Section 07 92 00 JOINT SEALANTS.

2.2.4 Adhesives

Provide sealants as specified in Section 07 92 00 JOINT SEALANTS.

2.2.5 Insect Screening

ASTM D3656/D3656M, Class 2, 18 by 14 mesh, color charcoal .

2.2.6 Accessories

As standard with the manufacturer and as specified herein.

2.3 WINDOW TYPES

Provide windows of the following types, as indicated.

2.3.1 Awning Windows

AAMA/WDMA/CSA 101/I.S.2/A440, Type A- LC 25. Provide compression-type weatherstripping.

2.3.2 Hung Windows

AAMA/WDMA/CSA 101/I.S.2/A440, Type H- R 15 .

2.3.3 Fixed Windows

AAMA/WDMA/CSA 101/I.S.2/A440, Type F- R 15 .

2.4 FABRICATION

Conform to AAMA/WDMA/CSA 101/I.S.2/A440 and to the requirements specified herein.

2.4.1 Subframes, Mullions and Transom Bars

Provide subframes, transom bars and mullions between multiple window units which meet the design pressure to meet the wind design loads indicated onthe structural drawings. Fabricate mullions and transom bars in such a manner as to permit expansion and contraction between adjoining construction and window units and to form a weathertight joint. Provide mullion covers on the interior and exterior to completely close exposed joints and recesses between window units and to present a neat appearance.

2.4.2 Combination Windows

Provide factory assembled combination windows of the same grade and performance class. Where factory assembly of individual windows into larger units is limited by transportation considerations, prefabricate, match mark, transport, and field assemble.

2.4.3 Frames and Sash

2.4.3.1 Corners and Reinforcement

Provide mechanically fixed and sealed or welded corners on PVC frames and sashes. Reinforce frames and sash as necessary to meet the requirements for the performance classes or grades specified herein.

2.4.3.2 Adjustability

Ventilating sash must be adjustable vertically and horizontally to ensure smooth operation.

2.4.3.3 Drips and Weep Holes

Provide continuous drips over heads of top ventilators. Where fixed windows adjoin ventilators, provide continuous drips across tops of fixed windows. Provide drips and weep holes as required to return water to the outside.

2.4.3.4 Provisions for Glazing

Design windows and rabbets suitable for glass thickness shown or specified. Design sash for inside triple glazing and for securing glass with glazing beads, glazing clips, glazing channels, glazing gaskets, or glazing compound.

2.4.4 Hardware

The item, type, and functional characteristics must be the manufacturer's standard for the particular window type. Provide hardware of suitable design and of sufficient strength to perform the function for which it is used. Equip operating ventilators with a lock or latching device which can be secured from the inside.

2.4.5 Weatherstripping

Provide for ventilating sections of windows to ensure a weathertight seal meeting the infiltration requirements specified in

AAMA/WDMA/CSA 101/I.S.2/A440. Provide easily replaceable factory-applied weatherstripping.

2.4.6 Screens

Provide one insect screen for each operable exterior sash or ventilator.

Design screens to be rewirable, easily removable from inside the building, and to permit easy access to operating hardware.

2.4.7 Color

Provide white window fiberglass color. Color must be integral or co-extruded to the PVC to prevent heat build-up.

2.4.8 Fasteners

Provide fastener types as standard with the window manufacturer for windows, trim, and accessories. Fasteners exposed to the environment to be corrosion resistant coated steel, aluminum, or stainless steel compatible with the window material and adjoining construction, and of a type and size recommended by the manufacturer to meet the performance requirements.

2.4.9 Accessories

Provide windows complete with clips, fins, anchors, and other appurtenances necessary for complete installation and proper operation.

2.4.9.1 Anchors

Provide concealed anchors of the type recommended by the window manufacturer for the specific type of construction. Provide corrosion resistant anchors and fasteners compatible with the window and the adjoining construction. For each jamb 36 inches or longer, provide a minimum of three anchors located approximately 6 inches from each end and at midpoint. For jambs less than 36 inches long, provide two anchors.

2.4.9.2 Grills

Provide the manufacturer's standard grills for the windows indicated.

Grills must be removable type or sealed within insulating glass units.

Provide manufacturer's standard grill pattern design or as approved, unless otherwise indicated.

PART 3 EXECUTION

3.1 INSTALLATION

Install in accordance with the window manufacturer's printed instructions and details. Build in windows as work progresses or install without forcing into prepared window openings. Set windows at proper elevation, location, and reveal; plumb, square, level, and in alignment; and brace, strut, and stay properly to prevent distortion and misalignment. Bed screws or bolts in sill members, joints at mullions, contacts of windows with sills, built-in fins, and subframes in mastic sealant of a type recommended by the window manufacturer. Install and seal windows in a manner that will prevent entrance of water and wind. Fasten hardware to windows.

Any materials that show visual evidence of biological growth due to the presence of moisture must not be installed on the building project.

3.1.1 Anchors and Fastenings

Secure units to each other, to masonry, and to other adjoining construction with clips, fins, screws, or other devices recommended by the window manufacturer.

3.2 ADJUSTING

After installation of windows and completion of glazing and field painting, adjust ventilators and hardware to operate smoothly and to provide weathertight sealing when ventilators are closed and locked. Lubricate hardware and operating parts as necessary. Verify products are properly installed, connected, and adjusted.

3.3 CLEANING

Clean interior and exterior surfaces of window units of mortar, plaster, paint spattering spots, and other foreign matter to present a neat appearance, to prevent fouling of weathering surfaces and weatherstripping, and to prevent interference with operation of hardware. Replace stained, discolored, or abraded windows that cannot be restored to their original condition with new windows.

3.4 PROTECTION

Protect ventilators and operating parts against accumulation of dirt and building materials by keeping ventilators tightly closed and locked to frame.

-- End of Section --

AM#3...

SECTION 10 11 00

VISUAL DISPLAY UNITS

08/20

PART 1 GENERAL

1.1 REFERENCES

The publications listed below form a part of this specification to the extent referenced. The publications are referred to within the text by the basic designation only.

AMERICAN NATIONAL STANDARDS INSTITUTE (ANSI)

ANSI Z97.1 (2015) Safety Glazing Materials Used in

Buildings - Safety Performance

Specifications and Methods of Test

ASTM INTERNATIONAL (ASTM)

ASTM B221 (2021) Standard Specification for Aluminum and Aluminum-Alloy Extruded Bars, Rods, Wire, Profiles, and Tubes

ASTM B221M (2021) Standard Specification for Aluminum and Aluminum-Alloy Extruded Bars, Rods, Wire, Profiles, and Tubes (Metric)

ASTM C1048 (2018) Standard Specification for

Heat-Strengthened and Fully Tempered Flat

Glass

ASTM E84 (2023) Standard Test Method for Surface

Burning Characteristics of Building

Materials

ASTM F148 (2013) Binder Durability of Cork

Composition Gasket Materials

ASTM F152 (2024) Standard Test Methods for Tension

Testing of Nonmetallic Gasket Materials

ASTM F793/F793M (2020) Standard Classification of Wall

Coverings by Use Characteristics

CALIFORNIA DEPARTMENT OF PUBLIC HEALTH (CDPH)

CDPH SECTION 01350 (2017; Version 1.2) Standard Method for the Testing and Evaluation of Volatile

Organic Chemical Emissions from Indoor

Sources using Environmental Chambers

SCIENTIFIC CERTIFICATION SYSTEMS (SCS)

SCS SCS Global Services (SCS) Indoor Advantage

UL SOLUTIONS (UL)

UL 2818 (2022) GREENGUARD Certification Program

For Chemical Emissions For Building

Materials, Finishes And Furnishings

1.2 DEFINITIONS

The term visual display unit when used herein includes projection screens;

submit manufacturer's descriptive data and catalog cuts plus manufacturer's installation instructions, and cleaning and maintenance instructions.

Provide visual display units from manufacturer's standard product line.

1.3 SUBMITTALS

Government approval is required for submittals with a "G" or "S" classification. Submittals not having a "G" or "S" classification are for

Contractor Quality Control approval. Submit the following in accordance with Section 01 33 00 SUBMITTAL PROCEDURES:

SD-02 Shop Drawings

Placement Schedule

SD-03 Product Data

Projection Screen

SD-08 Manufacturer's Instructions

Manufacturer's Cleaning Instructions

Manufacturer's Printed Installation InstructionsSD-10 Operation and Maintenance Data

Visual Display Units, Data Package 1

1.4 DELIVERY, STORAGE, AND HANDLING

Deliver materials to the building site in the manufacturer's original unopened containers and store them in a clean dry area with temperature maintained above 50 degrees F. Stack materials according to manufacturer's recommendations. Allow visual display units to acclimate to the building temperature for 24 hours prior to installation.

1.5 WARRANTY

Provide manufacturer's warranty to repair or replace defective materials and workmanship for period of one year from date of final acceptance of the work.

PART 2 PRODUCTS

2.1 MATERIALS

For each type, submit a section of core material and backing showing the lamination of porcelain enamel coating on steel, colored cork, natural cork, woven fabric, non-woven fabric, or vinyl wall covering, as applicable. Submit a sample of hardwood, plastic laminate finish, or glass type, as applicable. Provide minimum 4 by 4 inch samples, or larger, showing range of color.

Submit manufacturers' descriptive product data for visual display unit indicated. Include manufacturers' literature, finishes, profiles and thicknesses of materials.

Submit manufacturers' operations and maintenance data for visual display unit in accordance with Section 01 78 23 OPERATIONS AND MAINTENANCE DATA.

2.2 PROJECTION SCREEN

Provide wall mounted motorized projection screen with 120V motor that is lubricated for life, quick reversal type, has overload protector, integral gears, and preset accessible limit switches. Provide flame retardant, mildew resistant, white matte screen with black masking borders that is tab tensioned. Tab tensioned screens have a vinyl surface that is stretchable.

Bottom of screen fabric is weighted with a metal rod. Provide roller of rigid metal at least 3 inches in diameter mounted on sound absorbing supports. Motor is end mounted or motor-in-roller design. Provide screen with a 3 position control switch to stop or reverse screen at any point.

Install the switch in a flush electrical box with cover plate, location(s) as shown on the Electrical drawings. All conduit and wiring from the control switch to the projection screen is furnished and installed by the

Contractor. . Provide wall mounted case of aluminum or steel . Screen is UL listed. Comply with electrical work requirements in Section

26 20 00 INTERIOR DISTRIBUTION SYSTEM.

2.3 COLOR

Provide finish colors for required items as indicated; colors listed are not intended to limit the selection of equal colors from other manufacturers.

PART 3 EXECUTION

3.1 PLACEMENT SCHEDULE

Provide visual display units as follows:

Room Name and

Number

Board Type Board Size Wall Location Mounting

Height

121 Projection

Screen

60" x 80" As indicated +8'-0"

Mounting height is defined as distance from finished floor to top of the visual display unit frame.

3.2 INSTALLATION

Do not install items that show visual evidence of biological growth.

Perform installation and assembly in accordance with manufacturer's printed installation instructions. Use concealed fasteners. Attach visual display units to the walls with suitable devices to anchor each unit. Furnish and install trim items, accessories and miscellaneous items in total, including but not limited to hardware, grounds, clips, backing materials, adhesives, brackets, and anchorages incidental to or necessary for a sound, secure, complete and finished installation. Do not initiate installation until completion of room painting and finishing operations. Install visual display units in locations and at mounting heights indicated. Install visual display units level and plumb, and if applicable align doors and adjust hardware. Repair or replace damaged units as directed by the

Contracting Officer.

3.3 CLEANING

Clean writing surfaces in accordance with manufacturer's cleaning instructions.

-- End of Section --...AM#3

NATIONAL INSTITUTE OF STANDARDS &

TECHNOLOGY (NIST) SCORES AND

CYBERSECURITY MATURITY MODEL

CERTIFICATION (CMMC)

BOB Team Procurement Analysts, POA District U.S. Army Corps of Engineers

22 April 2025

AGENDA

• CUI

• NIST Scores

• CMMC Certification

• PIEE and SPRS

• NIST = National Institute of Standards and Technology

• SPRS = Supplier Performance Risk System

• PIEE = Procurement Integrated Enterprise Environment

• CUI = Controlled Unclassified Information

• FCI= Federal Contract Information

• CTI = Controlled Technical Information (a subset of CUI)

• CMMC = Cybersecurity Maturity Model Certification

• FOUO = For Official Use Only

• C3PAO= CMMC Third-Party Assessor Organization

KEY TERMS

NIST 800-171

CUI

Applicable to all executive agencies and contractors

Applicable to all executive agencies contractors who store, generate, transfer, etc. CUI. Implemented by DoD in DFARS.

Applicable to Defense Industry Base

CMMC

Everyone WE implement CUI protections on documents WE create.

Contractors Contractors implement CUI protections. We include the clauses to ensure compliance.

DIB

Contractors implement additional requirements to ensure compliance with DoD requirements.

CUI

BUILDING STRONG®

27 MAY 09 – POTUS memo calling for examination of CUI and Interagency Task Force 04 NOV 10 – POTUS issues Executive Order 13556 Controlled Unclassified Information (CUI) 18 NOV 13 – Final rule passed, NIST SP 800-53, Unclassified Controlled Technical Information 01 AUG 15 – DoD publishes guidance on DFARS Clause 252.204-7012 - Safeguarding Unclassified CTI 26 AUG 15 – Interim rule passed, NIST SP 800-171, Covered Defense Information 30 DEC 15 – Interim rule passes, NIST SP 800-171, Operationally Critical Support 14 SEP 16 – 32 CFR Part 2002 introduces the first legal framework for CUI 21 OCT 16 – Final rule passed, NIST SP 800-171 30 OCT 16 – DFARS 252.204-7012 goes into effect 15 NOV 18 – DoD Memo on implementing CUI 06 MAR 20 – DoD Instruction 5200.48 Established DoD CUI Policy 30 NOV 20 – DFARS interim rule goes into effect requiring NIST score in SPRS to receive awards 04 DEC 20 – Director of National Intelligence requests POTUS kill CUI and EO 13556 31 DEC 20 – Deadline for agencies to issue CUI implementation guidance

01 OCT 25 – CMMC goes into full effect, no award without at least Level 1 certification

HISTORY OF INFOSEC/ CYBERSECURITY

Can you objectively determine what information is or is not Controlled Unclassified Information

(CUI) in your organization?

SAFEGUARDING FCI AND CUI

FCI

Information that is not marked as public or for public release and is not designated as CUI

Defined in FAR 52.204-21, and

FAR 4.1901

Minimum safeguarding requirement: 48 CFR 52.204-

CUI

Information that is marked or identified as requiring safeguarding in the DoD CUI Program

Defined in 32 CFR Part 2002 Minimum safeguarding requirement: NIST SP 800-171

CUI BASICS

• SHARED responsibility of Government (GOV) and Contractor (KTR) personnel

• GOV responsibilities:

o Identification o Communication o Marking o Safeguarding

• KTR responsibilities:

o Marking o Safeguarding o Reporting – 100%, even suspected cyber incidents to DoD.

• DoD Cyber Crime Center = central node to report incidents: https://dibnet.dod.mil

• Can also report anomalous cyber activity 24/7 to: report@cisa.gov or (888) 282-0870

CUI - WHAT SHOULD HAPPEN?

• PM scans requirements documents for CUI, by element

• PM designates and marks all CUI in procurement package

• PDT safeguards CUI in accordance with statute/regs

• PM provides KO procurement package w/ guidance on what is/is not CUI

• KO includes INFOSEC (CUI, 889, NIST) provisions in Solicitation

• KTRs perform NIST evaluations and upload them to SAM.gov

• KTRs upgrade systems to plug holes, then maintain cyber “hygiene”

• Offeror(s) update their Reps and Certs with INFOSEC compliance

• KO downloads awardees NIST evaluation, stores in PCF prior to award

• KO includes INFOSEC (CUI, 889, NIST) clauses in final contract award

• KTRs pop smoke to DoD cyber crimes center for “suspected” breach(es)

• KO monitors KTR compliance and holds them accountable

• KO issues findings and puts KTRs on notice for noncompliance

• KO ensure CPARs reflect KTR noncompliance with INFOSEC req’ts

P R

E P

O S

T

KEY POINT:

CT is not/cannot be the CUI expert and Every requirement package must delineate CUI clearly

• Not all Government contracts involve CUI or FCI: Simple administrative contracts may not require handling sensitive information.

• Proper CUI and FCI handling is crucial: Contractors must implement appropriate security measures to protect this information.

• Contract language is important: Clearly define what constitutes CUI or FCI within the contract and specify the required security controls.

12INFOSEC/ CYBERSECURITY

CONSIDERATIONS

USACE still working through CUI implementation.

Contractor compliance with CUI marking/safeguarding/reporting increasing.

Successful implementation of both parts of Section 889.

Thus far in full compliance with NIST Scores.

Partnering with Small Business team to inform/train Defense Industrial Base.

Goal is increased communications with industry; permanent change.

Monitor CMMC changes and updates as implementation date nears.

Ongoing conversation to keep our industry partners aligned/informed.

.DODCUI.www mil

KEY POINT:

This DoD site is

GREAT

ALL the necessary info is there, text, tools, videos, etc. USE it

National Institute of Standards &Technology

(NIST) SCORES

TIMELINE INFOSEC CHANGES/ CHALLENGES

FY19 NDAA

Section 889b

SEP ‘20 NOV ‘20 OCT ‘25

National Institute of Standards and

Technology (NIST) Self Evaluation

Scores Req’d

Cybersecurity Maturity Model

Certification

(CMMC 2.0)

FY19 NDAA

Section 889a

SEP ‘19

No purchases from 5

Chinese firms

No tech anywhere in supply chain from 5 Chinese firms

Mandatory NIST scores or no contract awards, and protection of all CUI.

Mandatory CMMC certification for all contractors, Levels 1 to 3

DFARS

Controlled

Unclassified Info. (CUI)

Clause

OCT ‘16

DFARS 252.204-

7012, Contractors must comply with

CUI marking, safeguarding, reporting We are here

A reflection of a company's compliance with NIST-800-

A company's security posture

Let’s the Government know how a company is protecting Controlled Unclassified Information (CUI)

WHAT IS A NIST SCORE

WHAT IS A NIST SCORE

NIST SP

800-171

NIST SP

800-171A

NIST SP

800-172

NIST SP

800-172A

BASIC=

Required

Enhanced Security

• NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information (CUI) in Nonfederal

Systems and Organizations Security Requirements

• DoD’s 110 item Microsoft Excel checklist

• KTRs must self-assess their cyber hygiene annually

• KTRs upload their score into PIEE/SPRS

• Scores don’t matter, only that KTR performed the assessment

• NIST is a statutory mandate not a policy initiative

WHAT IS THE NIST REQUIREMENT?

NIST

FAR 52.204-28: Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (Order Level)

In all Federal Supply Schedules, Governmentwide acquisition contracts, and multi-agency contracts where Federal Acquisition Supply Chain Security Act (FASCSA) orders are applied at the order level. Include in the solicitation and resultant contract.

FAR 52.204-29: Federal Acquisition Supply Chain Security Act Orders—Representation and Disclosures.

In all solicitations, except for Federal Supply Schedules, Governmentwide acquisition contracts, and multi-agency contracts.

OR

In all solicitations for Federal Supply Schedules, Governmentwide acquisition contracts, and multi-agency contracts, if FASCSA orders are applied at the contract level (see 4.2304(b)(1)(i)).

FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders—Prohibition. (Base Level)

DoD FASCSA orders:

o (1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

o (2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 ( 47 U.S.C. 153);

o (3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or o (4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

Except for Federal Supply Schedules, Governmentwide acquisition contracts, and multi-agency contracts.

Required action by all awardees every 90 days- must go into SAM and recertify acknowledging compliance

52.204-30- Very important the contractor recertifies in SAM every 90 days as the information from SAM flows into CMMC

Covered Contractor Information System

• an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

DFARS 204.7303(b) The contracting officer shall verify that the summary level score of a current NIST SP 800- 171 DoD Assessment (i.e., not more than 3 years old) for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order are posted in Supplier Performance Risk System (SPRS) ( https://www.sprs.csd.disa.mil/), prior to—

(1) Awarding a contract, task order, or delivery order to an offeror or contractor that is required to implement NIST SP 800-171 in accordance with the clause at 252.204-7012; or

(2) Exercising an option period or extending the period of performance on a contract, task order, or delivery order with a contractor that is that is required to implement the NIST SP 800-171 in accordance with the clause at 252.204-7012.

204.7302 Policy.

(a) (1) Contractors and subcontractors are required to provide adequate security on all covered contractor information systems.

(2) Contractors required to implement NIST SP 800-171, in accordance with the clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber incident Reporting, are required at time of award to have at least a Basic NIST SP 800-171 DoD Assessment that is current (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7019).

(3) The NIST SP 800-171 DoD Assessment Methodology is located at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171

204.7303(b), the contracting officer shall verify that the summary level score of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old) in PIEE’s Supplier Performance Risk System (SPRS) prior to—

(1) Awarding a contract, task order, or delivery order to an offeror or contractor that is required to implement NIST SP 800- 171 in accordance with the clause at 252.204-7012; or

(2) Exercising an option period or extending the period of performance on a contract, task order, or delivery order with a contractor that is required to implement the NIST SP 800-171 in accordance with the clause at 252.204-7012.

Covered Contractor Information System

• an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Covered Defense Information

• unclassified controlled technical information or other information (as described in the Controlled Unclassified Information

(CUI) Registry at http://www.archives.gov/cui/registry/category-list.html) that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

COVERED CONTRACTOR AND DEFENSE

INFO

• The point of NIST scores is muscle memory.

• DoD’s goal: think about cyber hygiene 1x/year o Pay attention to security.

o Assess your hygiene.

o Fill your gaps.

o Report your status.

o Repeat.

• Just like taxes.

CUI

PRACTICE. PRACTICE. REPEAT.

Just Like this

NIST SCORES

No NIST SCORE = No Award

CMMC CERTIFICATION

CMMC

What happens on 1 OCT 25?

TIMELINE INFOSEC CHANGES / CHALLENGES

FY19 NDAA

Section 889b

SEP ‘20

NOV ‘20

OCT ‘25

National Institute of Standards and

Technology (NIST) Self Evaluation

Scores Req’d

Cybersecurity Maturity Model

Certification

(CMMC 2.0)

FY19 NDAA

Section 889a

SEP ‘19

No purchases from 5

Chinese firms

No tech anywhere in supply chain from 5 Chinese firms

Mandatory NIST scores or no contract awards, and protection of all CUI.

Mandatory CMMC certification for all contractors, Levels 1-2

DFARS

Controlled

Unclassified Info. (CUI)

Clause

OCT ‘16

DFARS 252.204-

7012, Contractors must comply with

CUI marking, safeguarding, reporting We are here

1 OCT 25.

Less than half a year

29CYBERSECURITY MATURITY

MODEL CERTIFICATION (CMMC)

30CYBERSECURITY MATURITY

LOW

31CYBERSECURITY MATURITY

32CYBERSECURITY MATURITY

52.204-21Basic Safeguarding of Covered Contractor Information Systems.

As prescribed in 4.1903 , insert the following clause:

BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (NOV 2021)

(a)Definitions. As used in this clause—Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction

(CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information ( 44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b)Safeguarding requirements and procedures.

33CYBERSECURITY MATURITY

(1)The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i)Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii)Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii)Verify and control/limit connections to and use of external information systems.

(iv)Control information posted or processed on publicly accessible information systems.

(v)Identify information system users, processes acting on behalf of users, or devices.

(vi)Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii)Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii)Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix)Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x)Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi)Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii)Identify, report, and correct information and information system flaws in a timely manner.

(xiii)Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv)Update malicious code protection mechanisms when new releases are available.

(xv)Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2)Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c)Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of clause)

34CYBERSECURITY MATURITY

CMMC Frequently Asked Questions (defense.gov)

CMMC LEVELS

Level 1 focuses on the protection of Federal Contract Information (FCI), which is defined in 32 CFR § 170.4 and 48 CFR § 4.1901: Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

LEVEL1

4.1901 Definitions.

As used in this subpart— Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple transactional information, such as that necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

The security requirements for a Level 2 self-assessment and a Level 2 certification assessment are the same, the only difference in these assessments is whether it is conducted by the Contractor or by an independent C3PAO.

Level 3 certification assessment, the OSC must have a Final Level 2 (C3PAO) CMMC Status for the same CMMC Assessment Scope as the Level 3 assessment. Any Level 2 Plan of Action and Milestones (POA&M) items, as defined in 32 CFR §170.4, must be closed prior to the initiation of the Level 3 assessment. The Level 3 CMMC Assessment Scope may be a subset of the Level 2 CMMC Assessment Scope (e.g., a Level 3 data enclave with greater restrictions and protections within the Level 2 data enclave).

SAFEGUARDING FCI AND CUI

FCI

Information that is not marked as public or for public release and is not designated as CUI

Defined in FAR 52.204-21, and

FAR 4.1901

Minimum safeguarding requirement: 48 CFR 52.204-

CUI

Information that is marked or identified as requiring safeguarding in the DoD CUI Program

Defined in 32 CFR Part 2002 Minimum safeguarding requirement: NIST SP 800-171

THE CMMC program helps ensure that DOD contractors and subcontractors comply with DOD requirements to safeguard

FCI and CUI.

CMMC DFAR PROCEDURES

DFARS 204-7502

a.) When a requiring activity identifies a specific CMMC level, the contracting officer shall NOT

1) Award to an offeror that does not have a CMMC certificate at the level required by the solicitation –or-

2) Exercise an option or extend any period of performance on a contract/TO or DO unless the contractor has a

CMMC certificate at the level required by the contract b.) Contracting Officer shall use SPRS to verify an offeror or contractor’s CMMC level.

DFARS 204-7503

Until 9/30/2025, in solicitation and contracts or TO or DO, including using FAR part 12 procedures for acquisition of commercial products and commercial services, except for solicitations and contracts or orders solely for acquisition of COTS requires a contractor to have a specific CMMC level.

On or after 10/1/2025, in all solicitations and contracts or TO or DO, including using FAR part 12 procedures for acquisition of commercial products and commercial services, except for solicitation and contracts or orders solely for the acquisition of COTS items.

CONTRACTOR RESPONSIBILITY

DFARS Clause 252.204-7021 The contractor is required to identify the appropriate CMMC status based on the type of information to be Processed, stored, or transmitted

Contractor/Subcontractor is required:

Develop and update artifacts and deliverables per RFI/RFP Conduct self-assessment Complete annual affirmation of continued compliance in SPRS Flow-down the DFARS clause 252.204-7021 to subcontractors

IMPLEMENTATION OF CMMC REQUIREMENTS

CMMC MAY BE APPLICABLE

Contracts that may involve the creation or storage of CUI or FCI include (not all inclusive):

A-E services for critical infrastructure

(A-E DB/DBB)

Facility renovation projects or system integration plans;

which include sensitive technical drawings

Building design contracts for military bases:

Architectural plans, electrical schematics, structural calculations, and security system layouts

Infrastructure renovation projects for Government facilities: Technical specifications for HVAC systems, plumbing layouts, fire suppression systems, and building access controls

Bridge engineering:

detailed design plans for bridge components, load calculations, and structural analysis data.

IT system integration projects for government agencies: Network architecture diagrams, data flow charts, system access control configurations, and user

Environmental impact assessment contracts: Site surveys, soil analysis reports, ecological studies, and mitigation plans

Legal services (expert witnesses, court transcription)

If it includes CUI, then the contract must include CMMC Level 2 requirements.

sensitive building functions security or safety measures sensitive data

These contracts could include CUI related to:

CMMC 2.0 IMPLEMENTATION

CMMC Level 1 (Foundational):

• Primary Clause: FAR 52.204- 21 (Basic safeguarding of

FCI)

• Key Points: Requires annual self-assessment to verify compliance with basic security practices for FCI.

CMMC Level 2 (Advanced):

• Primary Clauses: FAR 52.204-21 (FCI protection) and DFARS 252.204-7012 (CUI protection)

• Key Points: Includes all Level 1 requirements, plus additional NIST SP 800-171 Rev 2 security controls for CUI protection, requiring a third-party assessment.

CMMC Level 3 (Expert):

• Primary Clauses: FAR 52.204-21 (FCI protection) and DFARS 252.204-7012 (CUI protection)

• Key Points: Incorporates all Level 1 and Level 2 requirements, along with additional advanced security measures from NIST SP 800- 172 to mitigate threats from Advanced Persistent Threats (APTs).

FCI CUI

• Reviewing the System Security Plan (SSP): The contractor is required to submit their SSP detailing security practices and how they comply with NIST 800-171 requirements, which the Government can review for completeness and accuracy.

• Requesting evidence of controls: The Government may request documentation e.g. system scans, access control logs, incident response procedures, and other evidence to demonstrate the contractor's implementation of NIST 800-171 controls.

• Communication and collaboration: Maintaining open communication with the contractor is crucial for identifying potential compliance issues early and addressing them proactively.

• Risk-based approach: The Government may prioritize monitoring efforts based on the sensitivity of the data handled by the contractor and the potential impact of a security breach.

When monitoring a Contractor’s compliance, DoD personnel are:

-Safeguarding sensitive information to enable and protect the warfighter -Dynamically enhance DIB cybersecurity to meet evolving threats -Ensure accountability while minimizing barriers to compliance with DoD requirements -Contribute towards instilling a collaborative culture of cybersecurity and cyber resilience -Maintain public trust through high professional and ethical standards

MONITORING COMPLIANCE

MONITORING COMPLIANCE

KO Readiness Assessment: Just because someone gets Level 2 ready doesn't necessarily indicate they are high risk.

For example, what if we talk to them and they don't have the first clue what's going on, they just pencil whipped their assessment so the GOV money spigot didn't get shut off, this would be HI RISK.

CMMC WAIVER APPROVAL PROCESS

Program Manager

Chief Information Officer (CIO)

Program Executive Officer

Service Acquisition Executive (SAE) or Component

Acquisition Executive (CAE)

Department of Defense Chief Information Officer (DoD

CIO)

All waivers MUST be coordinated through Chief

Information Officer (CIO), prior to SAE or CAE approval

When market research indicates that including a CMMC assessment requirement may impede ability to generate robust competition or delay delivery of mission critical capabilities, the…