Cybersecurity Compliance Requirements V3 FINAL.pdf
PDF 191 KB Posted
- Attached to
- Dugway Proving Ground Environmental Support / Central Hazardous Waste Services - RFP Amendment 0006
- Solicitation number
- W911S626RA001
About this file
This is a cybersecurity compliance requirements document for the Army solicitation W911S626RA001 – Environmental Support Services, updated via Amendment 0005, establishing mandatory Cybersecurity Maturity Model Certification (CMMC) prerequisites for contract award.
Offerors handling Controlled Unclassified Information (CUI) must achieve CMMC Level 2 (Self) status prior to award, with a minimum score of 110 for Final certification or 88 out of 110 (0.8 ratio) for Conditional certification. Mandatory pre-award requirements include maintaining a current System Security Plan (SSP) documenting NIST SP 800-171 security controls implementation—an SSP cannot be deferred to a Plan of Action and Milestones (POA&M). Security requirements included in a POA&M cannot exceed a point value of 1 (except specific encryption requirements), and critical requirements such as SSP, External Connections, and Physical Access Logs cannot be included in POA&Ms at all. Conditional statuses expire if the POA&M is not successfully closed within 180 days of the CMMC status date. Prime contractors are responsible for ensuring all subcontractors processing, storing, or transmitting CUI achieve compliant CMMC status prior to subcontract award. Contractors must submit annual affirmations of continuous compliance through the Supplier Performance Risk System (SPRS) and maintain "audit readiness" for potential Government-led Medium or High-level assessments under DFARS clause 252.240-7997 at any time during performance. Failure to maintain valid CMMC status or pass Government-led assessments may result in contractual consequences including cure notices, mandatory remediation, or termination for cause. The document provides references to free DoD-funded resources including Project Spectrum, APEX Accelerators, DoD CIO CMMC Website, and SPRS Help Desk.
View the file
Other files
Show all 48
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cybersecurity Compliance Requirements for Controlled Unclassified Information
(CUI)
Solicitation: W911S626RA001 – Environmental Support Services
Data Requirement: Controlled Unclassified Information (CUI) (Updated via Amendment 0005)
1. PURPOSE
This acquisition involves handling Controlled Unclassified Information (CUI). In accordance with the Cybersecurity Maturity Model Certification (CMMC) Program (32 CFR Part 170, DFARS 252.204-7021) and the 2026 FAR/DFARS Overhaul (Class Deviation 2026-O0025), offerors must comply with strict cybersecurity requirements to be eligible for contract award. This attachment summarizes those requirements and directs offerors to official DoD-funded resources for assistance.
2. OFFEROR REQUIREMENTS TO BE ELIGIBLE FOR AWARD
CMMC compliance is a pre-award responsibility and eligibility requirement. Offerors must complete and verify the following in the Supplier Performance Risk System (SPRS) prior to contract award:
• System Security Plan (SSP): Maintain a current SSP documenting the implementation of NIST SP 800-171 security controls. Note: An SSP is a critical requirement and cannot be deferred to a Plan of Action and Milestones
(POA&M).
• CMMC Level 2 (Self) Status & Minimum Score: Conduct an assessment scoring your network per DoD’s assessment methodology. To be eligible for award, your SPRS profile must reflect a CMMC Status of either Final Level 2 (Self) (score of 110) or Conditional Level 2 (Self).
• Conditional Threshold: To achieve a "Conditional" status, your assessment score ratio must be greater than or equal to 0.8 (a minimum passing score of 88 out of 110).
• POA&M Restrictions: No security requirements in the POA&M can have a point value greater than 1 (except specific encryption requirements).
Critical security requirements (e.g., SSP, External Connections, Physical Access Logs) cannot be included in a POA&M at all.
• POA&M Closure: Conditional statuses will expire if the POA&M is not successfully closed out within 180 days of the CMMC status date.
• Annual Affirmation: Ensure a senior company official submits the annual affirmation of continuous compliance within the SPRS "CMMC Assessment" module.
• Subcontractor Flow-Down: The Prime Contractor is responsible for ensuring all subcontractors who will process, store, or transmit CUI achieve a current, compliant CMMC status prior to subcontract award.
• Audit Readiness: Be prepared for Government-led Medium or High-level assessments under DFARS clause 252.240-7997, which validate your self-assessment and SSP.
3. GOVERNMENT AUTHORITY AND ENFORCEMENT
• Validation Rights: The Government retains the right to conduct Medium or High NIST SP 800-171A assessments at any time (pre-award, post-award, or during performance) to verify compliance beyond contractor self-attestation.
• Evidence Review: DFARS 252.240-7997 supersedes previous “basic” self-assessment-only clauses. Contractors must be “audit ready” at all times, meaning all evidence required to support a Government-led assessment is organized and available upon request.
• Contractual Consequences: Failure to maintain a valid CMMC status, or failure to pass a Government-led assessment, will result in contractual consequences.
Actions include, but are not limited to, cure notices, mandatory remediation periods, or termination for cause.
4. WHERE TO GET HELP (FREE DOD-FUNDED RESOURCES)
• Project Spectrum: Cybersecurity support and training for small businesses in the Defense Industrial Base (DIB).
Website: https://www.projectspectrum.io
• APEX Accelerators (formerly PTACs): Local offices offering free consulting on contracting and cybersecurity compliance, including SPRS registration assistance. Find your local office: https://www.apexaccelerators.us
• DoD CIO CMMC Website: Official CMMC program details, FAQs, and resources. Website: https://dodcio.defense.gov/CMMC/
• SPRS Help Desk: Technical support for SPRS and PIEE systems. Phone: 866- 618-5988 | Website: https://www.sprs.csd.disa.mil/ https://www.google.com/url?q=https%3A%2F%2Fwww.projectspectrum.io https://www.google.com/url?q=https%3A%2F%2Fwww.apexaccelerators.us https://www.google.com/url?q=https%3A%2F%2Fdodcio.defense.gov%2FCMMC%2F https://www.google.com/url?q=https%3A%2F%2Fwww.sprs.csd.disa.mil%2F
File details come from the government source that posted it. Updated .