THE QUICK READ
  1. The prime contract determines the assessment path
  2. Affirm compliance and close deficiencies
Research Bath Iron Works beyond the requirements.

Explore supply-chain relationships and public security observations.

View research plans →Save this guide free

Bath Iron Works requires a Level 2 C3PAO assessment for CUI-handling suppliers when BIW’s own contract requires that assessment.

The prime contract determines the assessment path

BIW’s instructions cover suppliers receiving, creating, processing, storing or transmitting CUI. Its page describes Level 2 self-assessment and C3PAO assessment as distinct paths, and excludes COTS suppliers from its general CMMC assessment statement. It does not impose one C3PAO requirement on every supplier.

Sources: [1]

Affirm compliance and close deficiencies

BIW calls for initial and annual affirmations by the senior representative responsible for CMMC compliance. It urges suppliers to close open POA&M requirements promptly and describes a 180-day closeout period for permitted CMMC POA&Ms. Applicable flowdown clauses appear in BIW’s supplier terms and conditions.

Sources: [1]
LETTERS, TERMS AND SUPPLIER INSTRUCTIONS

Source documents