Notice to Industry - Application of Cybersecurity Maturity Model Certification (CMMC) Requirements
Special Notice Posted
- Solicitation number
- N62473CMMCNotice
- Agency
-
Department of the Navy
Department of Defense
- Set-aside
- No set-aside
Opportunity facts
- Place of performance
- San Diego, California, United States
Notice details come from SAM.gov. Updated .
About this opportunity
The Department of the Navy's Naval Facilities Engineering Systems Command (NAVFAC) Southwest Region published this Special Notice on March 27, 2026, to inform current and prospective contractors about Cybersecurity Maturity Model Certification (CMMC) requirements that will apply to their Planning, Design and Construction (PDC) contracts. The notice applies to all NAVFAC SW Multiple Award Construction Contracts (MACCs) and Architect-Engineer IDIQ Contracts moving forward. This is an informational notice designed to provide industry with advance notice of upcoming cybersecurity compliance obligations and implementation timelines. The Department of War is implementing the CMMC program government-wide, with NAVFAC SW integrating these requirements into its contracting practices. The notice does not constitute a solicitation or guarantee of award but rather serves as formal notification of future contract conditions.
The objective of this Special Notice is to alert contractors that CMMC certification will become a mandatory condition of contract award, with the applicable certification level determined by whether the contractor's information systems will process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Effective November 10, 2026, all prospective contractors seeking IDIQ awards from NAVFAC SW PDC must obtain CMMC Level 2 (C3PAO) certification or higher, though individual task orders may be assigned lower certification levels as appropriate. Contractors are required to maintain current CMMC status in the Supplier Performance Risk System (SPRS) with applicable assessment results and affirmations prior to contract award. Immediate actions required include accessing SPRS at https://piee.eb.mil/, verifying current CMMC status is properly posted, and ensuring the posted status reflects their cybersecurity posture and aligns with required CMMC levels. These requirements apply to both prime contractors and subcontractors engaged in work under NAVFAC SW contracts.
Notice text
Notice to Industry – Application of Cybersecurity Maturity Model Certification (CMMC) Requirements
NAVFAC SOUTHWEST (SW) provides this notice to Industry to inform current and prospective contractors about the CMMC Requirements under all NAVFAC SW Planning, Design and Construction (PDC) Multiple Award Construction Contracts (MACCs) and Architect-Engineer IDIQ Contracts.
Future contract actions shall include the CMMC requirements in accordance with Department of War (DoW) implementation of the CMMC program.
As DoW continues implementation of the CMMC program, solicitations and contracts shall identify when contractor information systems are expected to process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The applicable CMMC level will be identified in the solicitation and contract.
Offerors shall be required to have a current CMMC status recorded in the Supplier Performance Risk System (SPRS), including applicable assessment results and affirmations, as a condition of award for the contract, task order, and associated options where CMMC requirements apply.
In order to receive an IDIQ award from NAVFAC SW PDC, on or after November 10, 2026, prospective contractors must show that they have obtained a CMMC Level 2 (C3PAO) or higher. Task orders issued under NAVFAC SW IDIQs may be assigned a CMMC Level below Level 2 (C3PAO); however, for the majority of work under Construction and Architect-Engineering IDIQs, it is anticipated that a Level 2 (C3PAO) certification will be required after November 10, 2026.
Immediate Steps Required
We urge all contractors and subcontractors to take the following immediate steps to prevent any disruption to your contract eligibility:
- Access SPRS: Log in to the SPRS on PIEE, at https://piee.eb.mil/
- SPRS Vendor (Role) & Cyber Reports Access:
https://www.sprs.csd.disa.mil/pdf/SPRS_Access_CyberReports.pdf
- SPRS CMMC Level 2 Entry tutorial: https://www.sprs.csd.disa.mil/videos/Tutorials/CMMCL2SelfAssessment/CMMCLevel2selfassessmenttutorial.html
- How to upload CMMC Level Training offered on SPRS as an Affirming Official (AO) https://www.sprs.csd.disa.mil/cmmc.htm
- Verify Your Status: Confirm that your firm has a current CMMC status type properly posted in SPRS.
- Ensure Accuracy: Validate that the posted CMMC status type accurately reflects your current cybersecurity posture as it aligns with the CMMC level required by your existing or potential contracts.
This notice is for informational purposes only and does not constitute a solicitation, a request for proposal, nor a guarantee of award.
Files
| File | Type | Posted |
|---|---|---|
| Notice to Industry Statement for Sam.pdf |
On GovTribe
Work this opportunity
- Track it in your pipeline
- Find teaming partners
- Similar opportunities
- Ask GovTribe AI about this opportunity