IPE - TRAINING

In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for One (1) Computer Numerical Control (CNC) Plasma Cutting Machine.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0001 3431-N00001797 1.000 EA $ _______________ $ ______________
IPE Welding and Thermal Cutting Equipm
PRICING TERMS: Firm Fixed Price
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0001 7016220810 0001 N/A N/A N/A 04/06/2028

SUPPLIES/SERVICES: 3460-N00004594
ITEM DESCRIPTION:
In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for Training.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
SPE4A8-26-Q-0042
SUPPLY/SERVICE: 3460-N00004594 CONT'D
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0002 3460-N00004594 1.000 EA $ _______________ $ ______________
IPE Training
PRICING TERMS: Firm Fixed Price
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0002 7016220810 0002 N/A N/A N/A 04/06/2028

SUPPLIES/SERVICES: 3460-N00004592
ITEM DESCRIPTION:
In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for Technical Data.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0003 3460-N00004592 1.000 LT $ _______________ $ ______________
IPE Technical Data
PRICING TERMS: Firm Fixed Price
SPE4A8-26-Q-0042
SUPPLY/SERVICE: 3460-N00004592 CONT'D
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0003 7016220810 0003 N/A N/A N/A 04/06/2028

SUPPLIES/SERVICES: 3460-N00004587
ITEM DESCRIPTION:
In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for IUID Tag.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0004 3460-N00004587 1.000 EA $ _______________ $ ______________
IPE IUID Tag
PRICING TERMS: Firm Fixed Price
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
SPE4A8-26-Q-0042
SUPPLY/SERVICE: 3460-N00004587 CONT'D
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0004 7016220810 0004 N/A N/A N/A 04/06/2028

SUPPLIES/SERVICES: 3460-N00004591
ITEM DESCRIPTION:
In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for Shipping.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0005 3460-N00004591 1.000 EA $ _______________ $ ______________
IPE Shipping
PRICING TERMS: Firm Fixed Price
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
SPE4A8-26-Q-0042
SUPPLY/SERVICE: 3460-N00004591 CONT'D
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0005 7016220810 0005 N/A N/A N/A 04/06/2028

SUPPLIES/SERVICES: 3460-N00004586
ITEM DESCRIPTION:
In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for Installation.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0006 3460-N00004586 1.000 EA $ _______________ $ ______________
IPE Installation
PRICING TERMS: Firm Fixed Price
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0006 7016220810 0006 N/A N/A N/A 04/06/2026

SPE4A8-26-Q-0042
SUPPLY/SERVICE: 3460-N00004584 CONT'D
SUPPLIES/SERVICES: 3460-N00004584
ITEM DESCRIPTION:
In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for Foundation.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0007 3460-N00004584 1.000 EA $ _______________ $ ______________
IPE Foundation
PRICING TERMS: Firm Fixed Price
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0007 7016220810 0007 N/A N/A N/A 04/06/2028

SUPPLIES/SERVICES: 3460-N00001786
ITEM DESCRIPTION:
In accordance with Purchase Description VIBB 24-25-2001, Dated 11 March 2026 for Post Processor.
DLA issues this document using the DoD authorized unit of issue, please refer to the following URL to determine the corresponding ANSI X12 unit of issue.
SPE4A8-26-Q-0042
SUPPLY/SERVICE: 3460-N00001786 CONT'D
https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.dla.mil%2FPortals%2F104%2FDocuments%2FDLMS% 2FeApplications%2FLogDataAdmin%2FUnitofIssueandPurchaseUnit.xlsx&wdOrigin=BROWSELINK
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT.
0008 3460-N00001786 1.000 EA $ _______________ $ ______________
IPE Post Processor
PRICING TERMS: Firm Fixed Price
QTY VARIANCE: PLUS 0% MINUS 0%
INSPECTION POINT: ORIGIN
ACCEPTANCE POINT: DESTINATION
FOB: DESTINATION DELIVERY DATE: 365 DAYS ADO
PREP FOR DELIVERY:
WILL BE PACKAGED IN ACCORDANCE WITH ASTM D3951.
FREIGHT SHIPPING ADDRESS:
KOUROKU KIMURA
USN SRF (SRF-JRMC)
YOKOSUKA-SHI, KANAGAWA-KEN, JAPAN 238-0001
PARCEL POST ADDRESS:
USN SRF YOKOSUKA
PSC 473, BOX 8
ATTN: C/620
FPO, AP 96349
DODAAC:
N00024
GOVT USE
External External External Customer RDD/ ITEM PR PRLI PR PRLI Material Need Ship Date. 0008 7016220810 0008 N/A N/A N/A 04/06/2028

SPE4A8-26-Q-0042
Form
252.225-7974 REPRESENTATION REGARDING BUSINESS OPERATIONS WITH THE MADURO REGIME (DEVIATION 2020-O0005)
(FEB 2020) DFARS
(a) Definitions. As used in this provision -
“Agency or instrumentality of the government of Venezuela” means an agency or instrumentality of a foreign state as defined in section 28 U.S.
C. 1603(b), with each reference in such section to “a foreign state” deemed to be a reference to “Venezuela.”
“Business operations” means engaging in commerce in any form, including acquiring, developing, maintaining, owning, selling, possessing,
leasing, or operating equipment, facilities, personnel, products, services, personal property, real property, or any other apparatus of business
or commerce.
“Government of Venezuela” means the government of any political subdivision of Venezuela, and any agency or instrumentality of the
government of Venezuela.
“Person” means -
(1) A natural person, corporation, company, business association, partnership, society, trust, or any other nongovernmental entity,
organization, or group;
(2) Any governmental entity or instrumentality of a government, including a multilateral development institution (as defined in section 1701
(c)(3) of the International Financial Institutions Act (22 U.S.C. 262r(c)(3)); and
(3) Any successor, subunit, parent entity, or subsidiary of, or any entity under common ownership or control with, any entity described in
paragraphs (1) or (2) of this definition.
(b) Prohibition. In accordance with section 890 of the National Defense Authorization Act for Fiscal Year 2020 (Pub. L. 116-92), contracting
officers are prohibited from entering into a contract for the procurement of products or services with any person that has business operations
with an authority of the government of Venezuela that is not recognized as the legitimate government of Venezuela by the United States
Government, unless the person has a valid license to operate in Venezuela issued by the Office of Foreign Assets Control of the Department
of the Treasury.
(c) Representation. By submission of its offer, the Offeror represents that the Offeror -
(1) Does not have any business operations with an authority of the Maduro regime or the government of Venezuela that is not recognized
as the legitimate government of Venezuela by the United States Government; or
(2) Has a valid license to operate in Venezuela issued by the Office of Foreign Assets Control of the Department of the Treasury.
(End of provision)
Part 12 Clauses
CLAUSES ADDED TO PART 12 BY ADDENDUM
52.202-1 DEFINITIONS (JUN 2020) FAR
52.203-3 GRATUITIES (APR 1984) FAR
52.203-5 COVENANT AGAINST CONTINGENT FEES (MAY 2014) FAR
52.203-6 RESTRICTIONS ON SUBCONTRACTOR SALES TO THE GOVERNMENT (JUN 2020) FAR
52.203-7 ANTI-KICKBACK PROCEDURES (JUN 2020) FAR
52.203-8 CANCELLATION, RECISSION, AND RECOVERY OF FUNDS FOR ILLEGAL OR IMPROPER ACTIVITY (MAY 2014) FAR
52.203-10 PRICE OR FEE ADJUSTMENT FOR ILLEGAL OR IMPROPER ACTIVITY (MAY 2014) FAR
52.203-14 DISPLAY OF HOTLINE POSTER (NOV 2021) FAR
As prescribed in 3.1004(b), insert the following clause:
(a) Definition.
“United States,” as used in this clause, means the 50 States, the District of Columbia, and outlying areas.
SPE4A8-26-Q-0042
Part 12 Clauses (CONTINUED)
(b) Display of fraud hotline poster(s). Except as provided in paragraph (c).
(1) During contract performance in the United States, the Contractor shall prominently display in common work areas within business segments performing
work under this contract and at contract work sites.
(i) Any agency fraud hotline poster or Department of Homeland Security (DHS) fraud hotline poster identified in paragraph (b)(3) of this clause; and
(ii) Any DHS fraud hotline poster subsequently identified by the Contracting Officer.
(2) Additionally, if the Contractor maintains a company website as a method of providing information to employees, the Contractor shall display an
electronic version of the poster(s) at the website.
(3) Any required posters may be obtained as follows:
Poster(s) Obtain from
&ZF2031401& &ZF2031402&
&ZF2031403& &ZF2031404&
(Contracting Officer shall insert --
(i) Appropriate agency name(s) and/or title of applicable Department of Homeland Security fraud hotline poster); and
(ii) The website(s) or other contact information for obtaining the poster(s).)
(c) If the Contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism, such as a hotline poster, then the
Contractor need not display any agency fraud hotline posters as required in paragraph (b) of this clause, other than any required DHS posters.
(d) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in all subcontracts that exceed the threshold specified
in Federal Acquisition Regulation 3.1004(b)(1) on the date of subcontract award, except when the subcontract—
(1) Is for the acquisition of a commercial product or commercial service; or
(2) Is performed entirely outside the United States.
(End of clause)
52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL CONFIDENTIALITY AGREEMENTS OR STATEMENTS (JAN 2017)
FAR
252.203-7000 REQUIREMENTS RELATING TO COMPENSATION OF FORMER DOD OFFICIALS (SEP 2011) DFARS
252.203-7001 PROHIBITION ON PERSONS CONVICTED OF FRAUD OR OTHER DEFENSE-CONTRACT-RELATED FELONIES (JAN
2023) DFARS
252.203-7002 REQUIREMENT TO INFORM EMPLOYEES OF WHISTLEBLOWER RIGHTS (DEC 2022) DFARS
252.203-7003 AGENCY OFFICE OF THE INSPECTOR GENERAL (AUG 2019) DFARS
252.204-7021 CONTRACTOR COMPLIANCE WITH THE CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL
REQUIREMENTS (NOV 2025) DFARS
(a) Definitions. As used in this clause
Controlled unclassified information means information the Government creates or possesses, or information an entity creates or possesses for or on behalf of
the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls ( 32
CFR 2002.4(h) ).
Current means -
(1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status -
(i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO))
assessments, with -
(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and
(B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and
(ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with -
(A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and
(B) A corresponding affirmation of continuous compliance by an affirming official;
(2) With regard to Final CMMC Status -
(i) Not older than 1 year for Final Level 1 (Self), with -
(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and
(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official;
(ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with -
(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and
(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and
(iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with -
(A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and
(B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and
(3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32
CFR part 170.
SPE4A8-26-Q-0042
Part 12 Clauses (CONTINUED)
Cybersecurity Maturity Model Certification (CMMC) status means the result of meeting or exceeding the minimum required score for the corresponding
assessment. The potential statuses are as follows:
(1) Final Level 1 (Self).
(2) Conditional Level 2 (Self).
(3) Final Level 2 (Self).
(4) Conditional Level 2 (C3PAO).
(5) Final Level 2 (C3PAO).
(6) Conditional Level 3 (DIBCAC).
(7) Final Level 3 (DIBCAC).
Cybersecurity Maturity Model Certification unique identifier (CMMC UID) means 10 alpha-numeric characters assigned to each CMMC assessment and
reflected in the Supplier Performance Risk System (SPRS) for each contractor information system.
Federal contract information (FCI) means information, not intended for public release, that is provided by or generated for the Government under a contract
to develop or deliver a product or service to the Government. It does not include information provided by the Government to the public, such as on public
websites, or simple transactional information, such as information necessary to process payments.
Plan of action and milestones means a document that identifies tasks to be accomplished. It details resources required to accomplish the elements of the plan,
any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in National Institute of Standards and Technology Special
Publication 800-115 ( 32 CFR 170.21 ).
(b) Framework. The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's compliance with applicable
information security protections (see 32 CFR part 170).
(c) Duplication. The CMMC assessments will not duplicate efforts from any other comparable DoD assessment, except for rare circumstances when a
reassessment may be necessary, for example, when there are indications of issues with cybersecurity and/or compliance with CMMC requirements.
(d) Requirements. The Contractor shall -
(1)(i) Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: [Contracting Officer insert:
CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)] for all information systems used in performance of
the contract, task order, or delivery order that process, store, or transmit FCI or CUI; and
(ii) Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other
contractual instruments;
(2) Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required in paragraph (d)(1)
of this clause, or higher;
(3) Complete on an annual basis, and maintain as current, an affirmation, by the affirming official (see 32 CFR 170.4), of continuous compliance with the
requirements associated with the CMMC level required in paragraph (d)(1) of this clause in the Supplier Performance Risk System (SPRS) ( https://piee.eb.
mil) for each CMMC UID applicable to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in
performance of the contract;
(4) Ensure all subcontractors and suppliers complete prior to subcontract award, and maintain on an annual basis, an affirmation, by the affirming official
(see 32 CFR 170.4), of continuous compliance with the requirements associated with the CMMC level required for the subcontract or other contractual
instrument for each of the subcontractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the subcontract;
and
(5) If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC
Status of Final.
(e) Reporting. The Contractor shall -
(1) Submit to the Contracting Officer -
(i) The CMMC UID(s) issued by SPRS for contractor information systems that will process, store, or transmit FCI or CUI during performance of the
contract; and
(ii) Any changes in the CMMC UIDs generated in SPRS throughout the life of the contract, task order, or delivery order, if applicable;
(2) Enter into SPRS the results of a current self-assessment for each CMMC UID, not covered by a C3PAO assessment or DIBCAC assessment, applicable
to each of the contractor information systems that process, store, or transmit FCI or CUI and that are used in performance of the contract; and
(3) Complete in SPRS on an annual basis and maintain as current an affirmation of continuous compliance by the affirming official (see 32 CFR 170.4) for
each self-assessment, C3PAO assessment, or DIBCAC assessment required under the contract in SPRS.
(f) Subcontracts. The Contractor shall -
(1) Insert the substance of this clause, including this paragraph (f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments,
including those for the acquisition of commercial products and commercial services, excluding commercially available off-the-shelf items, if the subcontract
or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI; and
(2) Prior to awarding a subcontract or other contractual instrument, ensure that the subcontractor has a current CMMC certificate or current CMMC status at
the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.
(End of clause)
52.204-2 SECURITY REQUIREMENTS (MAR 2021) FAR
52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (DEVIATION 2026-O0038) (FEB 2026) FAR
52.204-13 SYSTEM FOR AWARD MANAGEMENT -MAINTENANCE (DEVIATION 2026-O0038) (FEB 2026) FAR
SPE4A8-26-Q-0042
Part 12 Clauses (CONTINUED)
52.204-14 SERVICE CONTRACT REPORTING REQUIREMENTS (DEVIATION 2026-O0038) (FEB 2026) FAR
52.204-15 SERVICE CONTRACT REPORTING REQUIREMENTS FOR INDEFINITE-DELIVERY CONTRACTS (DEVIATION 2026-O0038)
(FEB 2026) FAR
Standard Element ZA20413I has no Title
52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS (DEVIATION 2026-O0038) (FEB
2026) FAR
252.204-7003 CONTROL OF GOVERNMENT PERSONNEL WORK PRODUCT (APR 1992) DFARS
252.204-7004 ANTITERRORISM AWARENESS TRAINING FOR CONTRACTORS (JAN 2023) DFARS
252.204-7012 SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING (DEVIATION 2024-O0013)
(MAY 2024) DFARS
(a) Definitions. As used in this clause
Adequate security means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or
modification of information.
Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or
unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.
Contractor attributional/proprietary information means information that identifies the contractor(s), whether directly or indirectly, by the grouping of
information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade
secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.
Controlled technical information means technical information with military or space application that is subject to controls on the access, use, reproduction,
modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for
distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does
not include information that is lawfully publicly available without restrictions.
Covered contractor information system means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores,
or transmits covered defense information.
Covered defense information means unclassified controlled technical information or other information, as described in the Controlled Unclassified
Information (CUI)
Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law,
regulations, and Governmentwide policies, and is -
(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the
performance of the contract; or
(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.
Cyber incident means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an
information system and/or the information residing therein.
Forensic analysis means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the
integrity of the data.
Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or
disposition of information.
Malicious software means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality,
integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well
SPE4A8-26-Q-0042
Part 12 Clauses (CONTINUED)
as spyware and some forms of adware.
Media means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration
memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.
Operationally critical support means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or
logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.
Rapidly report means within 72 hours of discovery of any cyber incident.
Technical information means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013, Rights in Technical Data
--Other Than Commercial Products and Commercial Services, regardless of whether or not the clause is incorporated in this solicitation or contract.
Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process
sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer
software executable code and source code.
(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the
Contractor shall implement, at a minimum, the following information security protections:
(1) For covered contractor information systems that are part of an Information Technology (IT) service or system operated on behalf of the Government, the
following security requirements apply:
(i) Cloud computing services shall be subject to the security requirements specified in the clause 252.239-7010, Cloud Computing Services, of this contract.
(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.
(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not
subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:
(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in
National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal
Information Systems and Organizations”, Revision 2 (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171 ).
(ii)(A) The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017. For all contracts awarded prior to
October 1, 2017, the Contractor shall notify the DoD Chief Information Officer (CIO), via email at osd.dibcsia@mail.mil, within 30 days of contract award,
of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.
(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the DoD CIO. The
Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be nonapplicable or to have an
alternative, but equally effective, security measure that may be implemented in its place.
(C) If the DoD CIO has previously adjudicated the contractor's requests indicating that a requirement is not applicable or that an alternative security measure
is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.
(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this
contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the
Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline ( https:// http://www.fedramp.gov/resources/documents/)
and that the cloud service provider complies with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software,
media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.
(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures, in addition to
those identified in paragraphs (b)(1) and (2) of this clause, may be required to provide adequate security in a dynamic environment or to accommodate
special circumstances (e.g., medical devices) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These
measures may be addressed in a system security plan.
(c) Cyber incident reporting requirement.
(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein,
or that affects the contractor's ability to perform the requirements of the contract that are designated as operationally critical support and identified in the
contract, the Contractor shall -
(i) Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers,
specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as
well as other information systems on the Contractor's network(s), that may have been accessed as a result of the incident in order to identify compromised
covered defense information, or that affect the Contractor's ability to provide operationally critical support; and
SPE4A8-26-Q-0042
Part 12 Clauses (CONTINUED)
(ii) Rapidly report cyber incidents to DoD at https://dibnet.dod.mil.
(2) Cyber incident report. The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required
elements at https://dibnet.dod.mil.
(3) Medium assurance certificate requirement. In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or
acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate,
see https://public.cyber.mil/eca/.
(d) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit
the malicious software to DoD Cyber Crime Center (DC3) in accordance with NSN/Part Number: 3460N00004594 Quantity: 1 EA Delivery: 365 days ADO