D-J Engineering

Supplier Cybersecurity Survey

DJEF-SA-SS Rev L-b · Effective February 23, 2026

CMMC update

Update your cybersecurity representation

As a current approved Supplier in our data base, please fill out the attached update to our Supplier Survey. This in an update for our CMMC section. Please fill out the portion below and return to us to update our records. Supplier fills out all details, except those in the shaded box on Page 1.

Please note this is an update and will be included in the new form in the future.

D-J Engineering use only fields are not shown on the public form. Approval status, conditions, reviewer, and review date are completed by authorized staff after submission.

Website submission contact

This email address is used only to identify a contact for this website submission. It is not an added question in controlled form DJEF-SA-SS Rev L-b.

Contact email *

Supplier information

Supplier Name * Subsidiary of Address * City/State/Zip * Phone Number * Product/Processes for which survey is filled out *

Cybersecurity representation Complete all Yes / No / N/A questions. Conditional dates and assessment details are entered where applicable.

Section 5.1 Supplier Cybersecurity Representation

1 Are your company information systems compliant with the requirements of FAR 52.204-21 “Basic Safeguarding of Covered Contractor Information Systems”? Note: To be compliant, the FAR controls must be fully implemented. The requirements cannot be met with a Plan of Action and Milestone (POAM). *

Comments / explanation (if applicable)

2 Are these systems compliant with the requirements of DFARS 252.204-7012 “Safeguarding Covered Defense Information and Cyber Incident Reporting,” including use of external cloud service providers that meet the security requirements equivalent to those established by the Government for Federal Risk and Authorization Management Program (FedRAMP) moderate baseline? *

Comments / explanation (if applicable)

3 Have all 110 controls of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev 2 been implemented on the information systems? *

Comments / explanation (if applicable)

4 If 3 is answered “No,” is your information system operating under a Plan of Action and Milestones (POAM)? *

Comments / explanation (if applicable)

(i) Provide the POAM closure date:

Comments / explanation (if applicable)

(ii) Have all 31 Basic Security Requirement controls of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (Revision 2) been implemented into the information system? *

Comments / explanation (if applicable)

(iii) Have 100 or more controls of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (revision 2) been implemented into the information System? *

Comments / explanation (if applicable)

5 Does your company currently hold a Medium Level of Assurance (MLOA) Certificate to access DoD Cyber Crime Center (DC3) portal for cyber incident reporting as required by 252.204-7012(c)(3)? *

Comments / explanation (if applicable)

See https://www.dc3.mil/missions/dib-cybersecurity/dib-cybersecurity-dcise/ for details on cyber incident reporting.

6 Is your company compliant with the requirements of DFARS 252.204-7019 and DFARS 252.204-7020 “NIST SP 800-171 DoD Assessment Requirements”? Compliance requires the usage of the DoD Assessment Methodology, with submitted resulting scores to the Department of Defense website “Supplier Performance Rating System (SPRS). *

Comments / explanation (if applicable)

If “Yes” to question 6, please provide:

(i) Self-assessment or Defense Industrial Base Cyber Security Assessment Center (DIBCAC):

Comments / explanation (if applicable)

Self DIBCAC

(ii) If self-assessed, provide the date of the submission to SPRS:

Comments / explanation (if applicable)

(iii) If “DIBCAC”, what level assessment? Medium High

Comments / explanation (if applicable)

(iv) DIBCAC assessment date:

Comments / explanation (if applicable)

Section 5.2 Compliance to CMMC, DFARS 252.204-7021

CMMC Level 3 (DIBCAC):

Does your Company comply with CMMC Level 3 Certification requirements? *

Comments / explanation (if applicable)

If “Yes”,

Conditional: Date: , OR Final Date:

Comments / explanation (if applicable)

Date of Affirmation submitted to SPRS:

Comments / explanation (if applicable)

Note: If “Conditional Assessment”, POAM must be completed within 180 days.

If “No”, proceed to CMMC Level 2.

CMMC Level 2:

Does your Company comply with CMMC Level 2 Assessment/Certification requirements? *

Comments / explanation (if applicable)

If “Yes”,

Conditional (C3PAO): (C3PAO Name ) Date:

Comments / explanation (if applicable)

Date of Affirmation submitted to SPRS:

Comments / explanation (if applicable)

OR

Final (C3PAO): (C3PAO Name ) Date:

Comments / explanation (if applicable)

Date of Affirmation submitted to SPRS:

Comments / explanation (if applicable)

OR

Final (Self): Date: ,

Comments / explanation (if applicable)

Date of Affirmation submitted to SPRS:

Comments / explanation (if applicable)

Note: If a Conditional Assessment, POAM must be completed within 180 days

If “No”, proceed to CMMC Level 1.

CMMC Level 1 (Self):

Does your Company comply with CMMC Level 1 Assessment Requirements? *

Comments / explanation (if applicable)

If “Yes”, date of Assessment submitted to SPRS:

Comments / explanation (if applicable)

Date of Affirmation submitted to SPRS:

Comments / explanation (if applicable)

Optional supporting documents Supporting PDFs

Optional website attachment area. Up to five PDFs, 5 MB each and 10 MB combined. This does not add a requirement to DJEF-SA-SS Rev L-b.