Potential Application of Cybersecurity Maturity Model Certification (CMMC) Requirements For SCB MAC

The Department of the Navy is providing an informational notice to current and prospective contractors for the SCB MAC IDIQ regarding the potential application of Cybersecurity Maturity Model Certification (CMMC) requirements. The notice informs contractors that future contract actions will include CMMC requirements in accordance with the Department of War's implementation of the CMMC program. Contractors are encouraged to review official CMMC guidance and resources and ensure that any required cybersecurity assessments and related information are accurately recorded in the Supplier Performance Risk System (SPRS). The notice does not change any existing contracts and does not impose new requirements. Specific cybersecurity and CMMC requirements will be identified in future solicitations and task/delivery order solicitations. • The CMMC program will be implemented in future contract actions. • Contractors must have a current CMMC status recorded in the SPRS. • The applicable CMMC level will be identified in the solicitation or delivery order. • Contractors must comply with applicable Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) cybersecurity provisions and clauses. • Contractors should review official CMMC guidance and resources and ensure that any required cybersecurity assessments and related information are accurately recorded in the SPRS.