Select this checkbox if the contract involves classified information or if the work is expected to require access to classified materials.

Select this checkbox if the contract has restrictions requiring US citizenship.

Select this checkbox if a DD254 form (Department of Defense Contract Security Classification Specification) is necessary for the contract. This form is typically required for contracts involving access to classified information.

Select this checkbox if the contract involves cloud services that must meet federal security standards as outlined by the Federal Risk and Authorization Management Program (FedRamp).

Select this checkbox if the contract requires compliance with NIST Special Publication 800-53, which provides a catalog of security and privacy controls for federal information systems and organizations.

Select this checkbox if the contract requires compliance with NIST Special Publication 800-171, which outlines security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations.

Select this checkbox if the contract must comply with the International Traffic in Arms Regulations (ITAR). This is important for contracts involving export-controlled information.

Enter, or click to select, the minimum level of security clearance required for the contract. Options include:

• Confidential
• Secret
• Top Secret
• Top Secret with SCI

Enter, or click to select, any additional clearance requirements beyond standard security clearances (for example, Sensitive Compartmented Information or Special Access Program requirements).

Select this checkbox if the contract requires Cybersecurity Maturity Model Certification (CMMC) compliance.

If certification information and contract settings are not aligned, Costpoint displays validation messages in the CMMC Warnings field. The validation messages are advisory only and do not prevent you from saving or processing the contract.

This read-only field displays active CMMC validation messages when certification requirements and related contract information require attention.

This field displays validation messages as a bulleted list and is visible only when one or more validation conditions exist. Costpoint automatically removes the messages and hides the field when all validation conditions are resolved.

Validation messages display for scenarios such as:

• A contract requires CMMC, but no CMMC certification is defined on the Required Certifications subtask.
• No certification has been designated as the organization's CMMC certification on the Manage Certifications screen.
• Required certifications exist, but the contract is not marked as CMMC Required.
• DFARS 252.204-7021 and contract certification settings appear to be out of sync.

Enter any information on CMMC requirements related to the contract.

CMMC aims to measure the maturity or level of the organization's cybersecurity processes in complying with the protection of controlled unclassified information (CUI) within the Defense Industrial Base (DIB) networks. There are various levels of CMMC certifications. Controls and processes associated with each level are aimed to reduce the risk against a specific set of cyber threats.