Free tools Windows power users keep installed
One-click scans. No signup required.
Before bidding, check the Navy solicitation and every amendment for the required cybersecurity clauses, covered information and systems, current DoD assessment records, and any required CMMC level. Then confirm that the relevant SPRS records match the systems and CAGE codes proposed for the work. A company-wide claim of compliance is not enough to establish that a specific contract’s requirements are met.
The solicitation’s terms control for that procurement. The steps below explain the current DoD-wide DFARS baseline as of October 7, 2026; they cannot determine the requirements of a Navy solicitation that has not been reviewed.
As an Amazon Associate I earn from qualifying purchases.
1. Start with the solicitation and its amendments
Read the solicitation, attachments, statement of work, and every amendment. Record the applicable DFARS provisions and clauses, any cybersecurity requirements in the work description, and the specific information and systems the work will involve. An amendment may change the requirements or the records the offeror must have in place, so review the complete current set rather than relying on an earlier version.
Search for these citations and check their actual text and applicability in the solicitation:
#1 Best Overall
| DFARS citation | What to establish for this bid |
|---|---|
| 252.204-7012 | Whether the covered-system safeguarding, cloud, and incident-related requirements apply to the work. |
| 252.204-7019 and 252.204-7020 | Whether assessment requirements apply and what assessment records must be available for the relevant systems. |
| 252.204-7021 | Whether the CMMC clause applies and, if so, what CMMC level and status the solicitation requires. |
| 252.204-7025 | Whether the CMMC-related solicitation provision applies and what it requires of the offeror. |
These citations are a screening list, not a conclusion that every clause applies to every Navy procurement. DFARS rules provide for use of certain safeguarding and assessment provisions in covered solicitations, with stated exceptions for commercial off-the-shelf (COTS) items; the CMMC clause has its own scope and implementation timing. Check the current clause text and solicitation rather than inferring coverage from the fact that the buyer is the Navy.
2. Determine which information and systems are in scope
Work out whether the contract will involve Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or both. Then map every contractor information system that will process, store, or transmit that information in performing the work. Include relevant external cloud services and subcontractor systems; leaving them out can make the assessment boundary or proposed status a poor match for the contract.
For each system, record its boundary, the information it handles, the CAGE code or codes associated with it, and the role it plays in performance. DFARS CMMC obligations attach to systems used for contract performance that handle FCI or CUI, and applicable obligations can flow down to subcontractors. Use this map to test whether the assessment and CMMC records actually cover the proposed work, rather than relying on a general corporate certification or status.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →3. Check the DoD assessment and its SPRS record
Where DFARS 252.204-7012 and associated assessment requirements apply, the offeror generally needs at least a Basic DoD Assessment for each covered contractor information system relevant to the offer. The assessment must be current—generally no more than three years old, unless the solicitation sets a shorter interval—and the summary score must be posted in the Supplier Performance Risk System (SPRS) before award.
Rank #3
Verify the record system by system. Confirm that its assessment is within the allowed age, that its score is posted, and that the system boundary and relevant CAGE codes correspond to the proposed contract work. A record for a different boundary or set of CAGE codes may not establish readiness for the systems in the bid. If the solicitation calls for a shorter assessment interval, use that interval instead of the general three-year period.
4. Check the CMMC requirement separately
Do not assume that meeting an assessment requirement answers the CMMC question. When the requiring activity specifies a CMMC level, the solicitation states the level required for that procurement. Check the SPRS CMMC status for each applicable system and its CMMC unique identifier (UID), and confirm that the status meets or exceeds the solicitation’s level.
DFARS permits conditional Level 2 and Level 3 status to support award within the allowed conditional period; Level 1 requires final status. Where the contract requires CMMC, the applicable status must also be maintained during performance. A current CMMC status is a condition the contracting officer checks under the cited DFARS procedures: the current DFARS text says, “Contracting officers shall not award a contract, task order, or delivery order to an offeror that does not have a current CMMC status at the CMMC level required by the solicitation.”
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems5. Include cloud providers and subcontractors in the bid plan
External cloud services
If an external cloud service provider handles covered defense information, DFARS 252.204-7012 requires security requirements equivalent to the FedRAMP Moderate baseline, along with applicable incident and reporting duties. Identify the provider and the covered information it will handle, then confirm how the solicitation and contract requirements apply to that arrangement.
Best Value
Subcontractors and suppliers
Identify subcontractors and suppliers whose systems will handle FCI or CUI. For applicable CMMC contracts, account for required annual affirmation and flowdown obligations. Confirm that each partner understands the requirements that apply to its part of the work and that its readiness, cost, and timing are reflected in the proposal plan.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Decide whether the bid is viable
Compare the requirement against the evidence and readiness for each in-scope system. A missing, stale, mismatched, or unposted assessment or status is an eligibility or schedule issue to resolve before proposal submission—not an assumption to leave for award. The contracting officer checks relevant records in SPRS under the cited DFARS procedures.
For a quick go/no-go review, use this checklist:
- Have you reviewed the solicitation, all amendments, attachments, and statement-of-work requirements?
- Have you recorded which cited DFARS provisions and clauses apply, and the CMMC level if one is specified?
- Have you identified the FCI or CUI involved and mapped the contractor, cloud, and subcontractor systems that handle it?
- Does each relevant system have the required assessment, with a current age and summary score posted in SPRS?
- Do the assessment boundary and CAGE codes match the proposed work?
- Where CMMC is required, does each applicable system have a qualifying current status and UID in SPRS?
- Can cloud providers and subcontractors meet the applicable requirements on the bid’s schedule and at its planned cost?
If any answer is unclear, resolve it against the solicitation, its attachments and amendments, the applicable DFARS text, and the contracting officer’s instructions before treating the bid as ready. Regulations, clause versions, CMMC implementation details, SPRS records, and solicitation terms can change; no general baseline can substitute for checking the live procurement documents.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How to compare cybersecurity demands across Navy opportunities
When screening multiple solicitations, compare the concrete work each one creates rather than assigning an informal numerical score. Record the required CMMC level and assessment type; the information and systems in scope; the assessment’s age and SPRS posting status; cloud obligations; subcontractor flowdown burden; and the time and cost needed to close each readiness gap. This makes differences that affect bid eligibility, proposal effort, and schedule visible before committing to an opportunity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
