Notice to Industry - Application of Cybersecurity Maturity Model Certification (CMMC) Requirements

The Naval Facilities Engineering Command (NAVFAC) is providing notice to industry about the application of Cybersecurity Maturity Model Certification (CMMC) requirements under all NAVFAC SW Planning, Design and Construction (PDC) Multiple Award Construction Contracts (MACCs) and Architect-Engineer IDIQ Contracts. The notice informs current and prospective contractors about the CMMC requirements and the need to have a current CMMC status recorded in the Supplier Performance Risk System (SPRS) as a condition of award. The notice also provides guidance on immediate steps required for contractors to prevent disruption to their contract eligibility. • The CMMC requirements will be included in future contract actions. • Contractors must have a current CMMC status recorded in SPRS. • The applicable CMMC level will be identified in the solicitation and contract. • Task orders issued under NAVFAC SW IDIQs may be assigned a CMMC Level below Level 2 (C3PAO). • Contractors must verify their status and ensure accuracy in SPRS.