DFARS 252.204-7025_.pdf
PDF 85 KB Posted
- Solicitation number
- W912QR26RA008
About this file
This is a federal contracting provision establishing Cybersecurity Maturity Model Certification (CMMC) level requirements for contract award and performance.
The provision requires offerors to achieve and maintain a specified CMMC level prior to contract, task order, or delivery order award for all contractor information systems that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI). The required CMMC level is determined at the task order level and must meet or exceed the standard outlined in 32 CFR part 170. Offerors must demonstrate current CMMC status in the Supplier Performance Risk System (SPRS) at https://piee.eb.mil and provide current affirmation of continuous compliance with applicable security requirements. If an offeror holds a CMMC Status of Conditional, they must successfully close out a valid plan of action and milestones to achieve Final status prior to award. Offerors are required to provide all CMMC unique identifiers (CMMC UIDs) issued by SPRS in their proposal for each information system handling FCI or CUI, and must update this list when new UIDs are generated following self-assessment results. Failure to meet these CMMC requirements renders an offeror ineligible for award.
View the file
Other files
Show all 27
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
252.204-7025 NOTICE OF CYBERSECURITY MATURITY MODEL CERTIFICATION
LEVEL REQUIREMENTS (NOV 2025)
(a) Definitions. As used in this provision, controlled unclassified information (CUI), current, Cybersecurity Maturity Model Certification (CMMC) status, Cybersecurity Maturity Model Certification unique identifier (CMMC UID), Federal contract information (FCI), and Plan of action and milestones have the meaning given in the Defense Federal Acquisition Regulation Supplement 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, clause of this solicitation.
(b)(1) Cybersecurity Maturity Model Certification (CMMC) level. The CMMC level required by this solicitation will be determined at the Task Order level. This CMMC level, or higher (see 32 CFR part 170), is required prior to award for each contractor information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the contract.
(2) The Offeror will not be eligible for award of a contract, task order, or delivery order resulting from this solicitation if the Offeror does not have, for each of the contractor information systems that will process, store, or transmit FCI or CUI and that will be used in performance of a contract resulting from this solicitation--
(i) The current CMMC status entered in the Supplier Performance Risk System (SPRS) (https://piee.eb.mil) at the CMMC level required by paragraph (b)(1) of this provision; and
(ii) A current affirmation of continuous compliance with the security requirements identified at 32 CFR part 170 in SPRS.
(c) Plan of action and milestones. If the Offeror has a CMMC Status of Conditional, the Offeror shall successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.
(d) CMMC unique identifiers. The Offeror shall provide, in the proposal, the CMMC unique identifier(s) (CMMC UIDs) issued by SPRS for each contractor information system that will process, store, or transmit FCI or CUI during performance of a contract, task order, or delivery order resulting from this solicitation. The Offeror also shall update the list when new CMMC UIDs are generated in SPRS. The CMMC UIDs are provided in SPRS after the Offeror enters the results of self-assessment(s) for each such information system.
(End of provision)
File details come from the government source that posted it. Updated .