How CMMC shows up in DoD contracts and proposals: DFARS 252.204-7021 and 252.204-7025, CMMC UIDs and SPRS entries, the Affirming Official, and winning work with a Conditional status.
What DFARS 252.204-7021 requires during performance: keeping a current status on every system that handles FCI or CUI, annual affirmations per CMMC UID, reporting UIDs to the contracting officer, closing POA&Ms, no duplicate assessments, and flow-down to subcontractors.
How a DoD solicitation states its CMMC requirement under DFARS 252.204-7025: the four levels a contracting officer can insert, eligibility for award, listing CMMC UIDs in the proposal, higher statuses satisfying lower ones, and Conditional status at award.
Who should be the CMMC Affirming Official, what each affirmation states, when affirmations are due, why every prime and subcontractor affirms for itself, what lapses if one is missed, Level 3's dual affirmation, and the False Claims Act context.
What goes into the Supplier Performance Risk System for CMMC: Level 1 and Level 2 self-assessment entries, C3PAO results arriving through eMASS, CMMC UIDs, status dates, the Level 1 yes or no entry, and how contracting officers use SPRS.
Whether a Conditional CMMC status is enough for award: the 88-point threshold, which requirements can and cannot wait on a POA&M, the 180-day clock and status date, what happens if it expires mid-contract, and why Level 1 has no Conditional status.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.