Notice to Industry – Potential Application of Cybersecurity Maturity Model Certification (CMMC) Requirements

The Department of the Navy is providing notice to industry about the potential application of Cybersecurity Maturity Model Certification (CMMC) requirements in future contract actions. The notice informs current and prospective contractors that CMMC requirements will be included in solicitations and contracts when contractor information systems are expected to process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The notice also lists the applicable Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) cybersecurity provisions and clauses that will be included in solicitations and contracts. Key points to consider: • The CMMC program is being implemented by the Department of War. • Contractors will be required to have a current CMMC status recorded in the Supplier Performance Risk System (SPRS) as a condition of award. • The applicable CMMC level will be identified in the solicitation or delivery order. • Contractors are encouraged to review official CMMC guidance and resources published by the Department of War. • Interested vendors should continue to monitor SAM.gov and other official Department of War communication channels for future opportunities.