Amendment 6: QAs

Amendment 0006 Q&A – 10.21.2026

The following serves as the government’s responses to all CMMC-related inquiries: The Government clarifies that solicitation requirements regarding the Cybersecurity Maturity Model Certification (CMMC) are updated via Amendment [0006].
Pursuant to DFARS 252.204-7025(b)(1), the required CMMC status prior to award of the basic IDIQ contract is CMMC Level 2 (Self-Assessment):
1. Final vs. Conditional Level 2 Status:
In accordance with CMMC program guidelines (32 CFR Part 170), the Government will accept either a Final OR Conditional CMMC Level 2 (Self-Assessment) status posted in the Supplier Performance Risk System (SPRS) prior to contract award. An offeror with an active Plan of Action and Milestones (POA&M) meeting the minimum CMMC score thresholds (valid for up to 180 days) satisfies the pre-award eligibility requirement for IDIQ award.

2. Applicable Clauses & Provisions:

The following clauses & provisions apply to this solicitation: DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) DFARS 252.204-7021 (Cybersecurity Maturity Model Certification Requirements) DFARS 252.204-7025 (CMMC Level Notice Provision)
DFARS 252.240-7997 (NIST SP 800-171 DoD Assessment Requirements)

3. No Third-Party Audit Required Pre-Award:

Offerors are not required to possess or submit a third-party C3PAO certification prior to contract award.

4. Submission Instructions:

Offerors are required to provide their CMMC Unique Identifier(s) (CMMC UIDs) and associated SPRS posting details proving active Final or Conditional CMMC Level 2 (Self) status within Volume I, Tab 3 (Representations and Certifications / Section K) of their proposal.

Amendment 0006 Q&A – 10.21.2026
#

Question / Inquiry

Response

Section L 6.1.3 p. 7 of 10 seems to provide
conflicting guidance on submitting Volume II:
“Offerors are requested to submit Volume II
(Substantiating Documentation) as a single,
consolidated PDF file organized with native
electronic PDF bookmarks (bookmarks shall
replicate physical dividers or tabs). To
accommodate file size constraints, offerors
should submit Volume II as multiple separately
bundled PDF files organized and labeled by
Technical Experience ID (e.g., 'Volume II - ID 3 Documentation.pdf').” Please clarify how Volume II is to be structured
for submittal. Due to size constraints, we
strongly recommend allowing for multiple PDF
files.
Could the Government please extend the