Cybersecurity Compliance Requirements.pdf
PDF 89 KB Posted
- Attached to
- Dugway Proving Ground Environmental Support / Central Hazardous Waste Services - RFP Amendment 0006
- Solicitation number
- W911S626RA001
About this file
This document is a cybersecurity compliance requirements attachment for a federal solicitation involving Controlled Unclassified Information (CUI).
Solicitation Overview and Requirements: Solicitation W911S626RA001 addresses Environmental Support Services and requires all offerors to comply with cybersecurity standards before contract award under the 2026 FAR/DFARS Overhaul (Class Deviation 2026-O0025). Offerors must maintain a current System Security Plan (SSP) documenting implementation of all 110 NIST SP 800-171 security controls, conduct a CMMC Level 2 (Self) assessment scoring their network per DoD's assessment methodology, and upload their summary assessment score and SSP affirmation to the Supplier Performance Risk System (SPRS) via the Procurement Integrated Enterprise Environment (PIEE). Additionally, a senior company official must submit an annual affirmation of continuous compliance in SPRS, and offerors must be prepared for Government-led Medium or High level assessments under DFARS clause 252.240-7997 that validate self-assessments and SSPs.
Government Authority and Support Resources: The Government retains the right to conduct Medium or High NIST SP 800-171A assessments to verify compliance beyond contractor self-attestation, with DFARS 252.240-7997 superseding previous basic self-assessment-only clauses and emphasizing validation and evidence review. The document directs offerors to free DoD-funded resources including Project Spectrum (cybersecurity support for small businesses in the Defense Industrial Base), APEX Accelerators (local offices offering free consulting on contracting and cybersecurity compliance), the DoD CIO CMMC Website, and the SPRS Help Desk (866-618-5988).
View the file
Other files
Show all 48
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cybersecurity Compliance Requirements for Controlled Unclassified Information
(CUI)
Solicitation: W911S626RA001 – Environmental Support Services Data Requirement: Controlled Unclassified Information (CUI)
1. PURPOSE
This acquisition involves handling Controlled Unclassified Information (CUI). In accordance with the 2026 FAR/DFARS Overhaul (Class Deviation 2026-O0025), offerors must comply with cybersecurity requirements before contract award. This attachment summarizes those requirements and directs offerors to official DoD-funded resources for assistance.
2. OFFEROR REQUIREMENTS TO BE ELIGIBLE FOR AWARD
Offerors must complete the following prior to contract award:
• System Security Plan (SSP): Maintain a current SSP documenting implementation of all 110 NIST SP 800-171 security controls.
• Self-Assessment: Conduct a CMMC Level 2 (Self) assessment scoring your network per DoD’s assessment methodology.
• SPRS Submission: Upload your summary assessment score and SSP affirmation to the Supplier Performance Risk System (SPRS) via the Procurement Integrated Enterprise Environment (PIEE).
• Annual Affirmation: Ensure a senior company official submits the annual affirmation of continuous compliance in SPRS.
• Audit Readiness: Be prepared for Government-led Medium or High level assessments under DFARS clause 252.240-7997, which validate your self-assessment and SSP.
3. GOVERNMENT AUTHORITY AND ENFORCEMENT
• The Government retains the right to conduct Medium or High NIST SP 800-171A assessments to verify compliance beyond contractor self-attestation.
• DFARS 252.240-7997 supersedes previous “basic” self-assessment-only clauses, emphasizing validation and evidence review.
• Self-assessment remains a mandatory requirement where specified, but contractors must be “audit ready” at all times.
4. WHERE TO GET HELP (FREE DOD-FUNDED RESOURCES)
• Project Spectrum: Cybersecurity support and training for small businesses in the Defense Industrial Base (DIB).
Website: https://www.projectspectrum.io
• APEX Accelerators (formerly PTACs): Local offices offering free consulting on contracting and cybersecurity compliance, including SPRS registration assistance.
Find your local office: https://www.apexaccelerators.us
• DoD CIO CMMC Website: Official CMMC program details, FAQs, and resources.
Website: https://dodcio.defense.gov/CMMC/
• SPRS Help Desk: Technical support for SPRS and PIEE systems.
Phone: 866-618-5988 Website: https://www.sprs.csd.disa.mil/ https://www.projectspectrum.io/ https://www.apexaccelerators.us/ https://dodcio.defense.gov/CMMC/ https://www.sprs.csd.disa.mil/
File details come from the government source that posted it. Updated .