PART 204—ADMINISTRATIVE AND INFORMATION MATTERS Authority: 41 U.S.C. 1303 and 48 CFR chapter 1. Source: 56 FR 36289, July 31, 1991, unless otherwise noted. Subpart 204.1—Contract Execution 204.101 Contracting officer's signature. Follow the procedures at PGI 204.101 for signature of contract documents. [71 FR 9268, Feb. 23, 2006] Subpart 204.2—Contract Distribution 204.201 Procedures. Follow the procedures at PGI 204.201 for the distribution of contracts and modifications. (a) In lieu of the requirement at FAR 4.201 (a), contracting officers shall distribute one signed copy or reproduction of the signed contract to the contractor. [70 FR 58982, Oct. 11, 2005, as amended at 80 FR 58631, Sept. 30, 2015] 204.203 Taxpayer identification information. (b) The procedure at FAR 4.203(b) does not apply to contracts that include the provision at FAR 52.204-7, System for Award Management. The payment office obtains the taxpayer identification number and the type of organization from the System for Award Management database. [78 FR 28757, May 16, 2013] 204.270 Electronic Document Access. [75 FR 59102, Sept. 27, 2010, as amended at 80 FR 58631, Sept. 30, 2015] 204.270-1 Policy. (a) The Electronic Data Access (EDA) system, an online repository for contractual instruments and supporting documents, is DoD's primary tool for electronic distribution of contract documents and contract data. Contract attachments shall be uploaded to EDA, except for contract attachments that are classified, are too sensitive for widespread distribution ( e.g., e.g., (b) Agencies are responsible for ensuring the following when posting documents, including contractual instruments, to EDA— (1) The timely distribution of documents; and (2) That internal controls are in place to ensure that— (i) The electronic version of a contract document in EDA is an accurate representation of the contract; and (ii) The contract data in EDA is an accurate representation of the underlying contract. [80 FR 58631, Sept. 30, 2015, as amended at 84 FR 48510, Sept. 13, 2019] 204.270-2 Procedures. (b) The procedures at PGI 204.270-2 provide details on how to record the results of data verification in EDA. When these procedures are followed, contract documents and data in EDA are an accurate representation of the contract and therefore may be used for audit purposes. (c) The procedures at PGI 204.270-2(c) provide details on the creation and processing of contract deficiency reports, which are used to correct problems with contracts distributed in EDA. [80 FR 58631, Sept. 30, 2015, as amended at 81 FR 72738, Oct. 21, 2016] Subpart 204.4—Safeguarding Classified Information Within Industry 204.402 General. DoD employees or members of the Armed Forces who are assigned to or visiting a contractor facility and are engaged in oversight of an acquisition program will retain control of their work products, both classified and unclassified (see PGI 204.402). [71 FR 9268, Feb. 23, 2006, as amended at 76 FR 76319, Dec. 7, 2011] 204.403 Responsibilities of contracting officers. (1) Contracting officers shall ensure that solicitations comply with PGI 204.403(1). (2) For additional guidance on determining a project to be fundamental research in accordance with 252.204-7000(a)(3), see PGI 204.403(2). [79 FR 56278, Sept. 19, 2014] 204.404 Contract clause. 204.404-70 Additional contract clauses. (a) Use the clause at 252.204-7000, Disclosure of Information, in solicitations and contracts when the contractor will have access to or generate unclassified information that may be sensitive and inappropriate for release to the public. (b) Use the clause at 252.204-7003, Control of Government Personnel Work Product, in all solicitations and contracts. [57 FR 14992, Apr. 23, 1992, as amended at 64 FR 45197, Aug. 19, 1999; 84 FR 12139, Apr. 1, 2019] 204.470 U.S.-International Atomic Energy Agency Additional Protocol. 204.470-1 General. Under the U.S.-International Atomic Energy Agency Additional Protocol (U.S.-IAEA AP), the United States is required to declare a wide range of public and private nuclear-related activities to the IAEA and potentially provide access to IAEA inspectors for verification purposes. [74 FR 2412, Jan. 15, 2009] 204.470-2 National security exclusion. (a) The U.S.-IAEA AP permits the United States unilaterally to declare exclusions from inspection requirements for activities, or locations or information associated with such activities, with direct national security significance. (b) In order to ensure that all relevant activities are reviewed for direct national security significance, both current and former activities, and associated locations or information, are to be considered for applicability for a national security exclusion. (c) If a DoD program manager receives notification from a contractor that the contractor is required to report any of its activities in accordance with the U.S.-IAEA AP, the program manager will— (1) Conduct a security assessment to determine if, and by what means, access may be granted to the IAEA; or (2) Provide written justification to the component or agency treaty office for application of the national security exclusion at that location to exclude access by the IAEA, in accordance with DoD Instruction 2060.03, Application of the National Security Exclusion to the Agreements Between the United States of America and the International Atomic Energy Agency for the Application of Safeguards in the United States of America. [74 FR 2412, Jan. 15, 2009] 204.470-3 Contract clause. Use the clause at 252.204-7010, Requirement for Contractor to Notify DoD if the Contractor's Activities are Subject to Reporting Under the U.S.-International Atomic Energy Agency Additional Protocol, in solicitations and contracts for research and development or major defense acquisition programs involving— (a) Any fissionable materials (e.g., uranium, plutonium, neptunium, thorium, americium); (b) Other radiological source materials; or (c) Technologies directly related to nuclear power production, including nuclear or radiological waste materials. [74 FR 2412, Jan. 15, 2009] Subpart 204.6—Contract Reporting 204.602 General. See PGI 204.602 for additional information on the Federal Procurement Data System (FPDS) and procedures for resolving technical or policy issues relating to FPDS. [74 FR 37644, July 29, 2009] 204.604 Responsibilities. (1) The process for reporting contract actions to FPDS should, where possible, be automated by incorporating it into contract writing systems. (2) Data in FPDS is stored indefinitely and is electronically retrievable. Therefore, the contracting officer may reference the contract action report (CAR) approval date in the associated Government contract file instead of including a paper copy of the electronically submitted CAR in the file. Such reference satisfies contract file documentation requirements of FAR 4.803(a). (3) By December 15th of each year, the chief acquisition officer of each DoD component required to report its contract actions shall submit to the Principal Director, Defense Pricing, Contracting, and Acquisition Policy, its annual certification and data validation results for the preceding fiscal year in accordance with the DoD Data Improvement Plan requirements at https://www.acq.osd.mil/asda/dpc/ce/cap/index.html. [74 FR 37644, July 29, 2009, as amended at 87 FR 15817, Mar. 18, 2022; 89 FR 60831, July 29, 2024] 204.606 Reporting data. In addition to FAR 4.606, follow the procedures at PGI 204.606 for reporting data to FPDS. [74 FR 37644, July 29, 2009] Subpart 204.8—Contract Files 204.802 Contract files. (a) Any document posted to the Electronic Data Access (EDA) system is part of the contract file and is accessible by multiple parties, including the contractor. Do not include in EDA contract documents that are classified, too sensitive for widespread distribution ( e.g., e.g., (f) A photocopy, facsimile, electronic, mechanically-applied and printed signature, seal, and date are considered to be an original signature, seal, and date. [80 FR 58631, Sept. 30, 2015, as amended at 84 FR 48510, Sept. 13, 2019] 204.804 Closeout of contract files. (1) Except as provided in paragraph (3) of this section, contracting officers shall close out contracts in accordance with the procedures at PGI 204.804. The closeout date for file purposes shall be determined and documented by the procuring contracting officer. (2) The head of the contracting activity shall assign the highest priority to closeout of contracts awarded for performance in a contingency area. Heads of contracting activities shall monitor and assess on a regular basis the progress of contingency contract closeout activities and take appropriate steps if a backlog occurs. For guidance on the planning and execution of closing out such contracts, see PGI 207.105(b)(20)(C)( 8 (3)(i) In accordance with section 836 of the National Defense Authorization Act for Fiscal Year 2017 (Pub. L. 114-328), section 824 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91), and section 820 of the National Defense Authorization Act for Fiscal Year 2021 (Pub. L. 116-283), contracting officers may close out contracts or groups of contracts through issuance of one or more modifications to such contracts without completing a reconciliation audit or other corrective action in accordance with FAR 4.804-5(a)(3) through (15), as appropriate, if each contract— (A)( 1 ( 2 (B) The performance or delivery was completed at least 4 years prior to the current fiscal year; and (C) Has been determined by a contracting official, at least one level above the contracting officer, to be not otherwise reconcilable, because— ( 1 ( 2 (ii) Any contract or group of contracts meeting the requirements of paragraph (3)(i) of this section may be closed out through a negotiated settlement with the contractor. Except as provided in paragraph (3)(ii)(B) of this section, the contract closeout process shall include a bilateral modification of the affected contract, including those contracts that are closed out in accordance with a negotiated settlement. (A) For a contract or groups of contracts, the contracting officer shall prepare a negotiation settlement memorandum that describes how the requirements of paragraph (3)(i) of this section have been met. (B) For a group of contracts, a bilateral modification of at least one contract shall be made to reflect the negotiated settlement for a group of contracts, and unilateral modifications may be made, as appropriate, to other contracts in the group to reflect the negotiated settlement. (iii) For contract closeout actions under paragraph (3) of this section, remaining contract balances— (A) May be offset with balances in other contract line items within the same contract, regardless of the year or type of appropriation obligated to fund each contract line item and regardless of whether the appropriation obligated to fund such contract line item has closed; and (B) May be offset with balances on other contracts, regardless of the year or type of appropriations obligated to fund each contract and regardless of whether such appropriations have closed. (iv) USD(A&S) is authorized to waive any provision of acquisition law or regulation in order to carry out the closeout procedures authorized in paragraph (3)(i) of this section (see procedures at PGI 204.804(3)(iv). (4) When using the clause at 252.204-7022, Expediting Contract Closeout, to expedite contract closeout, determine the residual dollar amount upon completion of all applicable closeout requirements of FAR 4.804. [77 FR 30367, May 22, 2012, as amended at 80 FR 36901, June 26, 2015; 84 FR 18155, Apr. 30, 2019; 86 FR 27277, May 20, 2021; 87 FR 15813, Mar. 18, 2022] 204.804-70 Contract clause. Use the clause at 252.204-7022, Expediting Contract Closeout, in solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, when the contracting officer intends to expedite contract closeout through the mutual waiver of entitlement to a residual dollar amount of $1,000 or less determined at the time of contract closeout. [86 FR 27277, May 20, 2021, as amended at 88 FR 6580, Jan. 31, 2023] 204.805 Disposal of contract files. (1) The sources of the period for which contract files must be retained are General Records Schedule 3 (Procurement, Supply, and Grant Records) and General Records Schedule 6 (Accountable Officers' Accounts Records). Copies of the General Records Schedule may be obtained from the National Archives and Records Administration, Washington, DC 20408. (2) Deviations from the periods cannot be granted by the Defense Acquisition Regulatory Council. Forward requests for deviations to both the Government Accountability Office and the National Archives and Records Administration. (3) Hold completed contract files in the office responsible for maintaining them for a period of 12 months after completion. After the initial 12 month period, send the records to the local records holding or staging area until they are eligible for destruction. If no space is available locally, transfer the files to the General Services Administration Federal Records Center that services the area. (4) Duplicate or working contract files should contain no originals of materials that properly belong in the official files. Destroy working files as soon as practicable once they are no longer needed. (5) Retain pricing review files, containing documents related to reviews of the contractor's price proposals, subject to certified cost or pricing data (see FAR 15.403-4), for six years. If it is impossible to determine the final payment date in order to measure the six year period, retain the files for nine years. [56 FR 36289, July 31, 1991, as amended at 62 FR 40472, July 29, 1997; 63 FR 11528, Mar. 9, 1998; 71 FR 53044, Sept. 8, 2006; 77 FR 76939, Dec. 31, 2012; 80 FR 58632, Sept. 30, 2015] Subpart 204.9—Taxpayer Identification Number Information Source: 64 FR 43099, Aug. 9, 1999, unless otherwise noted. 204.902 General. (b) DoD uses the Federal Procurement Data System (FPDS) to meet these reporting requirements. [74 FR 37645, July 29, 2009] Subpart 204.11—System For Award Management Source: 68 FR 64558, Nov. 14, 2003, unless otherwise noted. 204.1103 Procedures. See PGI 204.1103 for helpful information on navigation and data entry in the System for Award Management (SAM) database. (1) On contract award documents, use the contractor's legal or “doing business as” name and physical address information as recorded in the SAM database at the time of award. (2) When making a determination to exercise an option, or at any other time before issuing a modification other than a unilateral modification making an administrative change, ensure that— (i) The contractor's record is active in the SAM database; and (ii) The contractor's unique entity identifier (UEI) number, Commercial and Government Entity (CAGE) code, name, and physical address are accurately reflected in the contract document. (3) At any time, if the UEI number, CAGE code, contractor name, or physical address on a contract no longer matches the information on the contractor's record in the SAM database, the contracting officer shall process a novation or change-of-name agreement, or an address change, as appropriate. (4) See PGI 204.1103 for additional requirements relating to use of information in the SAM database. (5) On contractual documents transmitted to the payment office, provide the CAGE code, instead of the UEI, in accordance with agency procedures. [74 FR 37643, July 29, 2009, as amended at 78 FR 28757, May 16, 2013; 89 FR 79002, Sept. 26, 2024] Subpart 204.12—Annual Representations and Certifications Source: 73 FR 1823, Jan. 10, 2008, unless otherwise noted. 204.1202 Solicitation provision and contract clause. When using the provision at FAR 52.204-8, Annual Representations and Certifications— (1) Use the provision with 252.204-7007, Alternate A, Annual Representations and Certifications; and (2) When the provision at FAR 52.204-7, System for Award Management, is included in the solicitation, do not include separately in the solicitation the following provisions, which are included in DFARS 252.204-7007: (i) 252.204-7016, Covered Defense Telecommunications Equipment or Services—Representation. (ii) 252.209-7002, Disclosure of Ownership or Control by a Foreign Government. (iii) 252.216-7008, Economic Price Adjustment—Wage Rates or Material Prices Controlled by a Foreign Government—Representation. (iv) 252.225-7000, Buy American—Balance of Payments Program Certificate. (v) 252.225-7020, Trade Agreements Certificate. (vi) 252.225-7031, Secondary Arab Boycott of Israel. (vii) 252.225-7035, Buy American—Free Trade Agreements—Balance of Payments Program Certificate. (viii) 252.225-7042, Authorization to Perform. (ix) 252.225-7049, Prohibition on Acquisition of Certain Foreign Commercial Satellite Services—Representations. (x) 252.225-7050, Disclosure of Ownership or Control by the Government of a Country that is a State Sponsor of Terrorism. (xi) 252.226-7002, Representation for Demonstration Project for Contractors Employing Persons with Disabilities. (xii) 252.229-7012, Tax Exemptions (Italy)—Representation. (xiii) 252.229-7013, Tax Exemptions (Spain)—Representation. (xiv) 252.232-7015, Performance-Based Payments—Representation. [76 FR 58141, Sept. 20, 2011, as amended at 77 FR 19129, Mar. 30, 2012; 77 FR 35879, June 15, 2012; 78 FR 37983, June 25, 2013; 78 FR 40043, July 3, 2013; 79 FR 45664, Aug. 5, 2014; 79 FR 51264, Aug. 28, 2014; 79 FR 73489, Dec. 11, 2014; 80 FR 5000, Jan. 29, 2015; 83 FR 24888, May 30, 2018; 83 FR 66071, Dec. 21, 2018; 84 FR 30947, June 28, 2019; 84 FR 72236, 72559, Dec. 31, 2019; 85 FR 19687, Apr. 8, 2020; 85 FR 74611, Nov. 23, 2020; 89 FR 78991, Sept. 26, 2024] Subpart 204.16—Uniform Procurement Instrument Identifiers Source: 81 FR 9785, Feb. 26, 2016, unless otherwise noted. 204.1601 Policy. (a) Establishment of a Procurement Instrument Identifier (PIID). (b) Transition of PIID numbering. (c) Change in the PIID after its assignment. (i) A continued contract— (A) Does not constitute a new procurement; (B) Incorporates all prices, terms, and conditions of the predecessor contract effective at the time of issuance of the continued contract; (C) Operates as a separate contract independent of the predecessor contract once issued; and (D) Shall not be used to evade competition requirements, expand the scope of work, or extend the period of performance beyond that of the predecessor contract. (ii) When issuing a continued contract, the contracting officer shall— (A) Issue an administrative modification to the predecessor contract to clearly state that— ( 1 e.g., ( 2 (B) Follow the procedures at PGI 204.1601(c). 204.1603 Procedures. (a) Elements of a PIID. (3) Position 9. (A) DoD will use three of the letters reserved for departmental or agency use in FAR 4.1603(a)(3) in this position as follows: ( 1 ( 2 ( 3 3 (B) Do not use other letters identified in FAR 4.1603(a)(3) as “Reserved for future Federal Governmentwide use” or “Reserved for departmental or agency use” in position 9 of the PIID. (C) Do not use the letter C or H for contracts or agreements with provisions for orders or calls. (4) Positions 10 through 17. (b) Elements of a supplementary PIID. 1 2 (2)(ii) Positions 2 through 6. ( 1 Positions 2 and 3. ( i ( ii ( a ( b ( iii ( a ( b ( iv ( 2 Positions 4 through 6. [81 FR 9785, Feb. 26, 2016, as amended at 88 FR 55938, Aug. 17, 2023] 204.1670 Cross reference to Federal Procurement Data System. Detailed guidance on mapping PIID and supplementary PIID numbers stored in the Electronic Data Access system to data elements reported in the Federal Procurement Data System can be found in PGI 204.1670. [81 FR 9785, Feb. 26, 2016, as amended at 84 FR 48510, Sept. 13, 2019] 204.1671 Order of application for modifications. (a) Circumstances may exist in which the numeric order of the modifications to a contract is not the order in which the changes to the contract actually take effect. (b) In order to determine the sequence of modifications to a contract or order, the modifications will be applied in the following order— (1) Modifications will be applied in order of the effective date on the modification; (2) In the event of two or more modifications with the same effective date, modifications will be applied in signature date order; and (3) In the event of two or more modifications with the same effective date and the same signature date, procuring contracting office modifications will be applied in numeric order, followed by contract administration office modifications in numeric order. SUBPART 204.17—SERVICE CONTRACTS INVENTORY Source: 86 FR 36236, July 9, 2021, unless otherwise noted. 204.1700 Scope of subpart. This subpart prescribes the requirement to report certain contracted services in accordance with 10 U.S.C. 4505. [86 FR 36236, July 9, 2021, as amended at 87 FR 76990, Dec. 16, 2022] 204.1701 Definitions. As used in this subpart— First-tier subcontract 204.1703 Reporting requirements. (a) Thresholds. (i) Has a total estimated value, including options, that exceeds $3 million; and (ii) Is for services in the following service acquisition portfolio groups (see PGI 204.1703 for a list of applicable product and service codes): (A) Logistics management services. (B) Equipment-related services. (C) Knowledge-based services. (D) Electronics and communications services. (b) Agency reporting responsibilities. (S-70) Contractor reporting. (2) For indefinite-delivery contracts, basic ordering agreements, and blanket purchase agreements— (i) Contractor reporting is required for each order issued under the contract or agreement that meets the requirements of paragraph (a) of this section; and (ii) Service contract reporting is not required for the basic contract or agreement. 204.1705 Contract clauses. (a)(i) Use the basic or the alternate of the clause at 252.204-7023, Reporting Requirements for Contracted Services, in solicitations, contracts, agreements, and orders, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, that— (A) Have a total estimated value, including options, that exceeds $3 million; and (B) Are for services in the following service acquisition portfolio groups: ( 1 ( 2 ( 3 ( 4 (ii) Use the basic clause in solicitations and contracts, except solicitations and resultant awards of indefinite-delivery contracts, and orders placed under non-DoD contracts that meet the criteria in paragraph (a)(i) of this section. (iii) Use the alternate I clause in solicitations and resultant awards of indefinite-delivery contracts, basic ordering agreements, and blanket purchase agreements, when one or more of the orders under the contract or agreement are expected to meet the criteria in paragraph (a)(i) of this section. [86 FR 36236, July 9, 2021, as amended at 88 FR 6580, Jan. 31, 2023] Subpart 204.18—Commercial and Government Entity Code Source: 79 FR 73492, Dec. 11, 2014, unless otherwise noted. 204.1870 Procedures. Follow the procedures and guidance at PGI 204-1870 concerning Commercial and Government Entity (CAGE) codes and CAGE file maintenance. Subpart 204.21—Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment Source: 84 FR 72236, Dec. 31, 2019, unless otherwise noted. 204.2100 Scope of subpart. This subpart implements section 1656 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) and section 889(a)(1)(A) of the National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232). 204.2101 Definitions. As used in this subpart— Covered defense telecommunications equipment or services (1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation, or any subsidiary or affiliate of such entities; (2) Telecommunications services provided by such entities or using such equipment; or (3) Telecommunications equipment or services produced or provided by an entity that the Secretary of Defense reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country. Covered foreign country (1) The People's Republic of China; or (2) The Russian Federation. Covered missions (1) The nuclear deterrence mission of DoD, including with respect to nuclear command, control, and communications, integrated tactical warning and attack assessment, and continuity of Government; or (2) The homeland defense mission of DoD, including with respect to ballistic missile defense. 204.2102 Prohibition. (a) Prohibited equipment, systems, or services. e.g., 204.2103 Procedures. (a) Representations. (1)(i) If the offeror selects “does not” in response to the provision at DFARS 252.204-7016, the contracting officer may rely on the representation, unless the contracting officer has an independent reason to question the representation. If the contracting officer has a reason to question the “does not” representation in FAR 52.204-26, FAR 52.212-3(v), or 252.204-7016, then the contracting officer shall consult with the requiring activity and legal counsel. (ii) If the offeror selects “does” in paragraph (c) of the provision at DFARS 252.204-7016, the offeror must complete the representation at DFARS 252.204-7017. (2)(i) If the offeror selects “will not” in paragraph (d) of the provision at DFARS 252.204-7017, the contracting officer may rely on the representation, unless the contracting officer has an independent reason to question the representation. If the contracting officer has a reason to question the “will not” representation in FAR 52.204-24 or DFARS 252.204-7017, then the contracting officer shall consult with the requiring activity and legal counsel. (ii) If an offeror selects “will” in paragraph (d) of the provision at DFARS 252.204-7017, the offeror must provide the information required by paragraph (e) of the provision. When an offeror completes paragraph (e) of either of the provisions at FAR 52.204-24 or DFARS 252.204-7017, the contracting officer shall— (A) Forward the offeror's representation and disclosure information to the requiring activity; and (B) Not award to the offeror unless the requiring activity advises— ( 1 ( 2 (b) Reporting. https://dibnet.dod.mil 204.2104 Waivers. The Secretary of Defense may waive the prohibition in 204.2102(a) on a case-by-case basis for a single, one-year period, if the Secretary— (a) Determines such waiver to be in the national security interests of the United States; and (b) Certifies to the Congressional defense committees that— (1) There are sufficient mitigations in place to guarantee the ability of the Secretary to carry out the covered missions; and (2) The Secretary is removing the use of covered defense telecommunications equipment or services in carrying out such missions. 204.2105 Solicitation provisions and contract clause. (a) Use the provision at 252.204-7016, Covered Defense Telecommunications Equipment or Services—Representation, in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, and solicitations for task orders and delivery orders, basic ordering agreements (BOAs), orders against BOAs, blanket purchase agreements (BPAs), and calls against BPAs. (b) Use the provision at 252.204-7017, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services—Representation, in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, and solicitations for task orders and delivery orders, BOAs, orders against BOAs, BPAs, and calls against BPAs. (c) Use the clause at 252.204-7018, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services, in all solicitations and resultant awards, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, and solicitations and awards for task orders and delivery orders, BOAs, orders against BOAs, BPAs, and calls against BPAs. [84 FR 72236, Dec. 31, 2019, as amended at 88 FR 6580, Jan. 31, 2023] Subpart 204.70—[Reserved] Subpart 204.71—Uniform Contract Line Item Numbering System 204.7100 Scope. This subpart prescribes policies and procedures for assigning contract line item numbers. 204.7101 Definitions. Accounting classification reference number (ACRN) Attachment Definitized item, Exhibit Nonseverable deliverable, Undefinitized item, [56 FR 36289, July 31, 1991, as amended at 60 FR 34468, July 3, 1995; 70 FR 58982, Oct. 11, 2005] 204.7102 Policy. (a) The numbering procedures of this subpart shall apply to all— (1) Solicitations; (2) Solicitation line and subline item numbers; (3) Contracts as defined in FAR Subpart 2.1; (4) Contract line and subline item numbers; (5) Exhibits; (6) Exhibit line items; and (7) Any other document expected to become part of the contract. (b) The numbering procedures are mandatory for all contracts where separate contract line item numbers are assigned, unless— (1) The contract is an indefinite-delivery type for petroleum products against which posts, camps, and stations issue delivery orders for products to be consumed by them; or (2) The contract is a communications service authorization issued by the Defense Information Systems Agency's Defense Information Technology Contracting Organization. [71 FR 9269, Feb. 23, 2006, as amended at 77 FR 76937, Dec. 31, 2012] 204.7103 Contract line items. Follow the procedures at PGI 204.7103 for establishing contract line items. [56 FR 36284, July 31, 1991, as amended at 79 FR 51264, Aug. 28, 2014] 204.7103-1 Criteria for establishing. Contracts shall identify the items or services to be acquired as separate contract line items unless it is not feasible to do so. (a) Contract line items shall have all four of the following characteristics; however, there are exceptions within the characteristics, which may make establishing a separate contract line item appropriate even though one of the characteristics appears to be missing— (1) Single unit price. (i) If the item is not separately priced (NSP) but the price is included in the unit price of another contract line item, enter NSP instead of the unit price; (ii) When there are associated subline items, established for other than informational reasons, and those subline items are priced in accordance with 204.7104; (iii) When the items or services are being acquired on a cost-reimbursement contract; (iv) When the contract is for maintenance and repair services (e.g., a labor hour contract) and firm prices have been established for elements of the total price of an item but the actual number and quantity of the elements are not known until performance. The contracting officer may structure these contracts to reflect a firm or estimated total amount for each line item; (v) When the contract line item is established to refer to an exhibit or an attachment (if management needs dictate that a unit price be entered, the price shall be set forth in the item description block and enclosed in parentheses); or (vi) When the contract is an indefinite delivery type contract and provides that the price of an item shall be determined at the time a delivery order is placed and the price is influenced by such factors as the quantity ordered (e.g., 10-99 @ $1.00, 100-249 @ $.98, 250+ @ $.95), the destination, the FOB point, or the type of packaging required. (2) Separately identifiable. (i) Supplies are separately identifiable if they have no more than one— (A) National stock number (NSN); (B) Item description; or (C) Manufacturer's part number. (ii) Services are separately identifiable if they have no more than one— (A) Scope of work; or (B) Description of services. (iii) This requirement does not apply if there are associated subline items, established for other than informational reasons, and those subline items include the actual detailed identification in accordance with 204.7104. Where this exception applies, use a general narrative description instead of the contract item description. (3) Separate delivery schedule. (i) The fact that there is more than one delivery date, destination, performance date, or performance point may be a determining factor in the decision as to whether to establish more than one contract line item. (ii) If a contract line item has more than one destination or delivery date, the contracting officer may create individual contract line items for the different destinations or delivery dates, or may specify the different delivery dates for the units by destination in the delivery schedule. (4) Single accounting classification citation. (ii) The use of multiple accounting classification citations for a contract line item is authorized in the following situations: (A) A single, nonseverable deliverable to be paid for with R&D or other funds properly incrementally obligated over several fiscal years in accordance with DoD policy; (B) A single, nonseverable deliverable to be paid for with different authorizations or appropriations, such as in the acquisition of a satellite or the modification of production tooling used to produce items being acquired by several activities; or (C) A modification to an existing contract line item for a nonseverable deliverable that results in the delivery of a modified item(s) where the item(s) and modification are to be paid for with different accounting classification citations. (iii) When the use of multiple accounting classification citations is authorized for a single contract line item, establish informational subline items for each accounting classification citation in accordance with 204.7104-1(a). (b) All subline items and exhibit line items under one contract line item shall be the same contract type as the contract line item. (c) For a contract that contains a combination of fixed-price line items, time-and-materials/labor-hour line items, and/or cost-reimbursement line items, identify the contract type for each contract line item in Section B, Supplies or Services and Prices/Costs, to facilitate appropriate payment. (d) Exhibits may be used as an alternative to putting a long list of contract line items in the schedule. If exhibits are used, create a contract line item citing the exhibit's identifier. See 204.7105. (e) If the contract involves a test model or a first article which must be approved, establish a separate contract line item or subline item for each item of supply or service which must be approved. If the test model or first article consists of a lot composed of a mixture of items, a single line item or subline item may be used for the lot. (f) If a supply or service involves ancillary functions, like packaging and handling, transportation, payment of state or local taxes, or use of reusable containers, and these functions are normally performed by the contractor and the contractor is normally entitled to reimbursement for performing these functions, do not establish a separate contract line item solely to account for these functions. However, do identify the functions in the contract schedule. If the offeror separately prices these functions, contracting officers may establish separate contract line items for the functions; however, the separate line items must conform to the requirements of paragraph (a) of this subsection. (g) Certain commercial products and initial provisioning spares for weapons systems are requested and subsequently solicited using units of measure such as kit, set, or lot. However, there are times when individual items within that kit, set, or lot are not grouped and delivered in a single shipment. This creates potential contract administration issues with inspection, acceptance, and payment. In such cases, solicitations should be structured to allow offerors to provide information about products that may not have been known to the Government prior to solicitation and propose an alternate line item structure as long as the alternate is consistent with the requirements of 204.71, which provides explicit guidance on the use of contract line items and subline items, and with PGI 204.71. [56 FR 36289, July 31, 1991, as amended at 60 FR 34468, July 3, 1995; 60 FR 43191, Aug. 18, 1995; 70 FR 58982, Oct. 11, 2005; 76 FR 58139, Sept. 20, 2011; 79 FR 11342, Feb. 28, 2014; 88 FR 6580, Jan. 31, 2023] 204.7103-2 Numbering procedures. Follow the procedures at PGI 204.7103-2 for numbering contract line items. [70 FR 58983, Oct. 11, 2005] 204.7104 Contract subline items. 204.7104-1 Criteria for establishing. Contract subline items provide flexibility to further identify elements within a contract line item for tracking performance or simplifying administration. There are only two kinds of subline items: those which are informational in nature and those which consist of more than one item that requires separate identification. (a) Informational subline items. (2) The informational subline item may include quantities, prices, or amounts, if necessary to satisfy management requirements. However, these elements shall be included within the item description in the supplies/services column and enclosed in parentheses to prevent confusing them with quantities, prices, or amounts that have contractual significance. Do not enter these elements in the quantity and price columns. (3) Informational subline items shall be used to identify each accounting classification citation assigned to a single contract line item number when use of multiple citations is authorized (see 204.7103-1(a)(4)(ii)). (b) Separately identified subline items. (i) Are to be paid for from more than one accounting classification. A subline item shall be established for the quantity associated with the single accounting classification citation. Establish a line item rather than a subline item if it is likely that a subline item may be assigned additional accounting classification citations at a later date. Identify the funding as described in 204.7104-1(a)(3); (ii) Are to be packaged in different sizes, each represented by its own NSN; (iii) Have collateral costs, such as packaging costs, but those costs are not a part of the unit price of the contract line item; (iv) Have different delivery dates or destinations or requisitions, or a combination of the three; or (v) Identify parts of an assembly or kit which— (A) Have to be separately identified at the time of shipment or performance; and (B) Are separately priced. (2) Each separately identified contract subline item shall have its own— (i) Delivery schedule, period of performance, or completion date; (ii) Unit price or single total price or amount (not separately priced (NSP) is acceptable as an entry for price or amount if the price is included in another subline item or a different contract line item). This requirement does not apply— (A) If the subline item was created to refer to an exhibit or an attachment. If management needs dictate that a unit price be entered, the price shall be set forth in the item description block of the schedule and enclosed in parentheses; or (B) In the case of indefinite delivery contracts described at 204.7103-1(a)(1)(vi). (iii) Identification (e.g., NSN, item description, manufacturer's part number, scope of work, description of services). (3) Unit prices and extended amounts. (i) The unit price and total amount for all subline items may be entered at the contract line item number level if the unit price for the subline items is identical. If there is any variation, the subline item unit prices shall be entered at the subline item level only. (ii) The unit price and extended amounts may be entered at the subline items level. (iii) The two methods in paragraphs (b)(3) (i) and (ii) of this section shall not be combined in a contract line item. (iv) When the price for items not separately priced is included in the price of another contract line or subline item, it may be necessary to withhold payment on the priced contract line or subline item until the included line or subline items that are not separately priced have been delivered. See the clause at 252.204-7002, Payment for Contract Line or Subline Items Not Separately Priced. [56 FR 36289, July 31, 1991, as amended at 60 FR 34468, July 3, 1995; 68 FR 75200, Dec. 30, 2003; 85 FR 19692, Apr. 8, 2020] 204.7104-2 Numbering procedures. Follow the procedures at PGI 204.7104-2 for numbering contract subline items. [70 FR 58983, Oct. 11, 2005] 204.7105 Contract exhibits and attachments. Follow the procedures at PGI 204.7105 for use and numbering of contract exhibits and attachments. [71 FR 9269, Feb. 23, 2006] 204.7106 Contract modifications. (a) If new items are added, assign new contract line or subline item numbers or exhibit line item numbers, in accordance with the procedures established at 204.7103, 204.7104, and 204.7105. (b) Modifications to existing contract line items or exhibit line items. (1) If the modification relates to existing contract line items or exhibit line items, the modification shall refer to those item numbers. (2) If the contracting officer decides to assign new identifications to existing contract or exhibit line items, the following rules apply— (i) Definitized and undefinitized items. (B) The original line item or subline item number may be used if the modification makes only minor changes in the specifications of some of the items ordered on the original line item or subline item and the resulting changes in unit price can be averaged to provide a new single unit price for the total quantity. If the changes in the specifications make the item significantly distinguishable from the original item or the resulting changes in unit price cannot be averaged, create a new line item. (C) If the modification affects only a partial quantity of an existing contract line item or subline item or exhibit line item and the change does not involve either the delivery date or the ship-to/mark-for data, the original contract line item or subline item or exhibit line item number shall remain with the unchanged quantity. Assign the changed quantity the next available number. (ii) Undefinitized items. (A) If the modification is undefinitized and increases the quantity of an existing definitized item, assign the undefinitized quantity the next available number. (B) If the modification increases the quantity of an existing undefinitized item, the original contract line item or subline item or exhibit line item may be used if the unit price for the new quantity is expected to be the same as the price for the original quantity. If the unit prices of the two quantities will be different, assign the new quantity the next available number. (C) If the modification both affects only a partial quantity of the existing contract line item or subline item or exhibit line item and definitizes the price for the affected portion, the definitized portion shall retain the original item number. If there is any undefinitized portion of the item, assign it the next available number. However, if the modification definitizes the price for the whole quantity of the line item, and price impact of the changed work can be apportioned equally over the whole to arrive at a new unit price, the quantity with the changes can be added into the quantity of the existing item. (D) If the modification affects only a partial quantity of an existing contract line item or subline item or exhibit line item but does not change the delivery schedule or definitize price, the unchanged portion shall retain the original contract line item or subline item or exhibit line item number. Assign the changed portion the next available number. (3) If the modification will decrease the amount obligated— (i) There shall be coordination between the administrative and procuring contracting offices before issuance of the modification; and (ii) The contracting officer shall not issue the modification unless sufficient unliquidated obligation exists or the purpose is to recover monies owed to the Government. [56 FR 36289, July 31, 1991, as amended at 70 FR 58983, Oct. 11, 2005; 77 FR 76937, Dec. 31, 2012; 78 FR 13543, Feb. 28, 2013] 204.7107 Contract accounting classification reference number (ACRN) and agency accounting identifier (AAI). Traceability of funds from accounting systems to contract actions is accomplished using ACRNs and AAIs. Follow the procedures at PGI 204.7107 for use of ACRNs and AAIs. [74 FR 52895, Oct. 15, 2009] 204.7108 Payment instructions. Follow the procedures at PGI 204.7108 for inclusion of payment instructions in contracts. [70 FR 58983, Oct. 11, 2005] 204.7109 Contract clauses. (a) Use the clause at 252.204-7002, Payment for Contract Line or Subline Items Not Separately Priced, in solicitations and contracts when the price for items not separately priced is included in the price of another contract line or subline item. (b) Use the clause at 252.204-7006, Billing Instructions—Cost Vouchers, in solicitations and contracts when a cost-reimbursement contract, a time-and-materials contract, or a labor-hour contract is contemplated. [85 FR 19692, Apr. 8, 2020, as amended at 88 FR 33833, May 25, 2023] Subpart 204.72—Antiterrorism Awareness Training Source: 84 FR 4363, Feb. 15, 2019, unless otherwise noted. 204.7200 Scope of subpart. This subpart provides policy and guidance related to antiterrorism awareness training for contractor personnel who require routine physical access to a Federally-controlled facility or military installation. 204.7201 Definition. As used in this subpart— Military installation 204.7202 Policy. It is DoD policy that— (a) Contractor personnel who, as a condition of contract performance, require routine physical access to a Federally-controlled facility or military installation are required to complete Level I antiterrorism awareness training within 30 days of requiring access and annually thereafter; and (b) In accordance with Department of Defense Instruction O-2000.16, Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards, Level I antiterrorism awareness training may be completed— (1) Through a DoD-sponsored and certified computer or web-based distance learning instruction for Level I antiterrorism awareness; or (2) Under the instruction of a qualified Level I antiterrorism awareness instructor. 204.7203 Contract clause. Include the clause at 252.204-7004, DoD Antiterrorism Awareness Training for Contractors, in solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, when contractor personnel require routine physical access to a Federally-controlled facility or military installation. [84 FR 4363, Feb. 15, 2019, as amended at 88 FR 6580, Jan. 31, 2023] Subpart 204.73—Safeguarding Covered Defense Information and Cyber Incident Reporting Source: 78 FR 69279, Nov. 18, 2013, unless otherwise noted. 204.7300 Scope. (a) This subpart applies to contracts and subcontracts requiring contractors and subcontractors to safeguard covered defense information that resides in or transits through covered contractor information systems by applying specified network security requirements. It also requires reporting of cyber incidents. (b) This subpart does not abrogate any other requirements regarding contractor physical, personnel, information, technical, or general administrative security operations governing the protection of unclassified information, nor does it affect requirements of the National Industrial Security Program. [80 FR 51742, Aug. 26, 2015, as amended at 81 FR 72998, Oct. 21, 2016] 204.7301 Definitions. As used in this subpart— Adequate security Contractor attributional/proprietary information e.g., Controlled technical information Covered contractor information system Covered defense information http://www.archives.gov/cui/registry/category-list.html (1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or (2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract. Information system Media Rapidly report Technical information [78 FR 69279, Nov. 18, 2013, as amended at 80 FR 51742, Aug. 26, 2015; 81 FR 72998, Oct. 21, 2016; 88 FR 6580, Jan. 31, 2023] 204.7302 Policy. (a)(1) Contractors and subcontractors are required to provide adequate security on all covered contractor information systems. (2) Contractors required to implement NIST SP 800-171, in accordance with the clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber incident Reporting, are required at time of award to have at least a Basic NIST SP 800-171 DoD Assessment that is current ( i.e., (3) The NIST SP 800-171 DoD Assessment Methodology is located at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171. (4) High NIST SP 800-171 DoD Assessments will be conducted by Government personnel using NIST SP 800-171A, “Assessing Security Requirements for Controlled Unclassified Information.” (5) The NIST SP 800-171 DoD Assessment will not duplicate efforts from any other DoD assessment or the Cybersecurity Maturity Model Certification (CMMC) (see subpart 204.75), except for rare circumstances when a re-assessment may be necessary, such as, but not limited to, when cybersecurity risks, threats, or awareness have changed, requiring a re-assessment to ensure current compliance. (b) Contractors and subcontractors are required to rapidly report cyber incidents directly to DoD at http://dibnet.dod.mil. (1) If a cyber incident occurs, contractors and subcontractors submit to DoD— (i) A cyber incident report; (ii) Malicious software, if detected and isolated; and (iii) Media (or access to covered contractor information systems and equipment) upon request. (2) Contracting officers shall refer to PGI 204.7303-4(c) for instructions on contractor submissions of media and malicious software. (c) Information shared by the contractor may include contractor attributional/proprietary information that is not customarily shared outside of the company, and that the unauthorized use or disclosure of such information could cause substantial competitive harm to the contractor that reported the information. The Government shall protect against the unauthorized use or release of information that includes contractor attributional/proprietary information. (d) A cyber incident that is reported by a contractor or subcontractor shall not, by itself, be interpreted as evidence that the contractor or subcontractor has failed to provide adequate security on their covered contractor information systems, or has otherwise failed to meet the requirements of the clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. When a cyber incident is reported, the contracting officer shall consult with the DoD component Chief Information Officer/cyber security office prior to assessing contractor compliance (see PGI 204.7303-3(a)(3)). The contracting officer shall consider such cyber incidents in the context of an overall assessment of a contractor's compliance with the requirements of the clause at 252.204-7012. (e) Support services contractors directly supporting Government activities related to safeguarding covered defense information and cyber incident reporting ( e.g., [80 FR 51742, Aug. 26, 2015, as amended at 81 FR 72998, Oct. 21, 2016; 85 FR 61519, Sept. 29, 2020; 87 FR 15817, Mar. 18, 2022] 204.7303 Procedures. (a) Follow the procedures relating to safeguarding covered defense information at PGI 204.7303. (b) The contracting officer shall verify that the summary level score of a current NIST SP 800-171 DoD Assessment ( i.e., https://www.sprs.csd.disa.mil/ (1) Awarding a contract, task order, or delivery order to an offeror or contractor that is required to implement NIST SP 800-171 in accordance with the clause at 252.204-7012; or (2) Exercising an option period or extending the period of performance on a contract, task order, or delivery order with a contractor that is that is required to implement the NIST SP 800-171 in accordance with the clause at 252.204-7012. [85 FR 61519, Sept. 29, 2020] 204.7304 Solicitation provisions and contract clauses. (a) Use the provision at 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls, in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items. (b) Use the clause at 252.204-7009, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, in all solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, for services that include support for the Government's activities related to safeguarding covered defense information and cyber incident reporting. (c) Use the clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, in all solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for solicitations and contracts solely for the acquisition of COTS items. (d) Use the provision at 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items. (e) Use the clause at 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, in all solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for those that are solely for the acquisition of COTS items. [80 FR 51743, Aug. 26, 2015, as amended at 80 FR 56929, Sept. 21, 2015; 81 FR 72999, Oct. 21, 2016; 82 FR 61480, Dec. 28, 2017; 85 FR 61519, Sept. 29, 2020; 88 FR 6581, Jan. 31, 2023] Subpart 204.74—Disclosure of information to litigation support contractors Source: 79 FR 11339, Feb. 28, 2014, unless otherwise noted. 204.7400 Scope of subpart. This subpart prescribes policies and procedures for the release and safeguarding of information to litigation support contractors. It implements the requirements at 10 U.S.C. 129d. 204.7401 Definitions. As used in this subpart— Computer software Litigation information Litigation support Litigation support contractor Sensitive information Technical data [81 FR 28727, May 10, 2016] 204.7402 Policy. (a) Any release or disclosure of litigation information that includes sensitive information to a litigation support contractor, and the litigation support contractor's use and handling of such information, shall comply with the requirements of 10 U.S.C. 129d. (b) To the maximum extent practicable, DoD will provide notice to an offeror or contractor submitting, delivering, or otherwise providing information to DoD in connection with an offer or performance of a contract that such information may be released or disclosed to litigation support contractors. (c) Information that is publicly available without restriction, including publicly available solicitations for litigation support services, will not be protected from disclosure as litigation information. (d) When sharing sensitive information with a litigation support contractor, contracting officers shall ensure that all other applicable requirements for handling and safeguarding the relevant types of sensitive information are included in the contract ( e.g., [79 FR 11339, Feb. 28, 2014, as amended at 81 FR 28728, May 10, 2016] 204.7403 Contract clauses. (a) Use the clause at 252.204-7014, Limitations on the Use or Disclosure of Information by Litigation Support Contractors, in all solicitations and contracts that involve litigation support services, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services. (b) Use the clause at 252.204-7015, Notice of Authorized Disclosure of Information for Litigation Support, in solicitations and contracts that involve litigation support services, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services. [81 FR 28728, May 10, 2016, as amended at 84 FR 58332, Oct. 31, 2019; 88 FR 6581, Jan. 31, 2023; 89 FR 90235, Nov. 15, 2024] Subpart 204.75—Cybersecurity Maturity Model Certification Source: 90 FR 43574, Sept. 10, 2025, unless otherwise noted. 204.7500 Scope of subpart. (a) This subpart prescribes policies and procedures for including the Cybersecurity Maturity Model Certification (CMMC) level requirements in DoD contracts. CMMC is a framework (see 32 CFR part 170) for assessing a contractor's information security protections. (b) This subpart does not abrogate any other requirements regarding contractor physical, personnel, information, technical, or general administrative security operations governing the protection of unclassified information, nor does it affect requirements of the National Industrial Security Program. (c) This subpart applies to unclassified contractor information systems. 204.7501 Definitions. As used in this subpart— Controlled unclassified information Current (1) With regard to Conditional Cybersecurity Maturity Model Certification (CMMC) Status— (i) Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments, with— (A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.16 and 170.17); and (B) A corresponding affirmation of continuous compliance by an affirming official (see 32 CFR 170.4); and (ii) Not older than 180 days for Conditional Level 3 (Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)) assessments, with— (A) No changes in compliance with the requirements at 32 CFR part 170 since the Conditional CMMC Status date (see 32 CFR 170.18); and (B) A corresponding affirmation of continuous compliance by an affirming official; (2) With regard to Final CMMC Status— (i) Not older than 1 year for Final Level 1 (Self), with— (A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.15); and (B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; (ii) Not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments, with— (A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.16 and 170.17); and (B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and (iii) Not older than 3 years for Final Level 3 (DIBCAC) assessments, with— (A) No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date (see 32 CFR 170.18); and (B) A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official; and (3) With regard to affirmation of continuous compliance (32 CFR 170.22), not older than 1 year with no changes in compliance with the requirements at 32 CFR part 170. Cybersecurity Maturity Model Certification (CMMC) status (1) Final Level 1 (Self). (2) Conditional Level 2 (Self). (3) Final Level 2 (Self). (4) Conditional Level 2 (C3PAO). (5) Final Level 2 (C3PAO). (6) Conditional Level 3 (DIBCAC). (7) Final Level 3 (DIBCAC). Cybersecurity Maturity Model Certification unique identifier (CMMC UID) Federal contract information (FCI) 204.7502 Policy. (a) Award eligibility. (2) Contracting officers shall not award a contract, task order, or delivery order to an offeror that does not have a current CMMC status at the CMMC level required by the solicitation. (3) Contractors are required to achieve, at time of award, a CMMC status at the CMMC level specified in the solicitation, or higher, for all information systems used in the performance of the contract, task order, or delivery order that will process, store, or transmit FCI or CUI. Contractors are required to maintain a current CMMC status at the specified CMMC level or higher, if required by the contract, task order, or delivery order, throughout the life of the contract, task order, or delivery order. (b) CMMC status. (i) Listed in the definition of “CMMC status”; and (ii) Equal to or higher than the CMMC level required by the solicitation or contract, task order, or delivery order. (2) CMMC levels 2 and 3 can be in a conditional level for a period not to exceed 180 days from the CMMC status date (32 CFR 170.21), and award can occur with a conditional CMMC level. CMMC level 1 requires a final CMMC level for award. 204.7503 Procedures. (a) CMMC level. (b) Award. (c) Option exercise or period of performance extension. (d) CMMC UIDs. 204.7504 Solicitation provision and contract clause. (a) Unless the requirements at 32 CFR 170.5(d) are met, use the clause at 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements, as follows: (1) Until November 9, 2028, in solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for those solely for the acquisition of commercially available off-the-shelf (COTS) items, if the program office or requiring activity determines that the contractor is required to have a specific CMMC level. (2) On or after November 10, 2028, in solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for those solely for the acquisition of COTS items, if the program office or requiring activity determines that the contractor is required to use contractor information systems in the performance of the contract, task order, or delivery order to process, store, or transmit FCI or CUI. (b) Use the provision at 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements, in solicitations that include the clause at 252.204-7021. Subpart 204.76—Supplier Performance Risk System Source: 88 FR 17338, Mar. 22, 2023, unless otherwise noted. 204.7600 Scope of subpart. This subpart provides policies and procedures for use of the Supplier Performance Risk System (SPRS) risk assessments in the evaluation of a quotation or offer. 204.7601 Definitions. As used in this subpart— Item risk Price risk Supplier risk 204.7602 Applicability. Use of SPRS risk assessments is required for the evaluation of quotations or offers in response to solicitations for supplies and services, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, excluding solicitations for the procurement of supplies or services exempted by the Department of Defense Instruction (DoDI) 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information. SPRS retrieves item, price, quality, delivery, and contractor information from contracts in Government reporting systems in order to develop risk assessments of contractors. SPRS is available at https://piee.eb.mil/, https://www.sprs.csd.disa.mil/reference.htm. 204.7603 Procedures. The contracting officer shall consider price risk and supplier risk, if available in SPRS, as a part of the award decision. For procurement of an end product identified by a material identifier that is available as described at PGI 204.7603, the contracting officer shall also consider assessments of item risk, if available, as a part of the award decision. Offerors or quoters without a risk assessment in SPRS shall not be considered favorably or unfavorably. Contracting officers shall use their discretion in considering the information available in SPRS on item risk, price risk, and supplier risk as follows: (a) Item risk. (2) Before issuing a solicitation for the procurement of an end product identified by a material identifier that is available as described at PGI 204.7603, the contracting officer shall ensure a SPRS item risk search has been performed and shall consider any item risk warnings provided. When evaluating quotations or offers for an end product identified by a material identifier, a SPRS item risk search is required for any end product that did not have an item risk search performed prior to solicitation. If there are item risk warnings, the contracting officer shall consider strategies to mitigate risk, such as the following: (i) Consulting with the program office. (ii) Including mitigating requirements in the statement of work, as provided by the requiring activity. (iii) Including FAR and DFARS clauses identified in the SPRS application, as appropriate. (b) Price risk. (2) The contracting officer shall consider strategies to mitigate price risk, such as the following: (i) Not awarding to offerors or quoters with high risk price ratings unless there is a way to justify the price through additional price or cost analysis. (ii) Utilizing appropriate price negotiation techniques and procedures. (iii) Using price reasonableness or price realism techniques at FAR 13.106 or 15.4. See also 215.403-3 when making award decisions. (c) Supplier risk. 204.7604 Solicitation provision. Except for supplies or services exempted by DoDI 5000.79, use the provision at 252.204-7024, Notice on the Use of the Supplier Performance Risk System, in solicitations for supplies and services, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services.