A requirements matrix for a pursuit decision has one row per condition, and every row carries five things a proposal outline doesn’t: the checkpoint at which the condition bites, the verbatim source text kept apart from your reading of it, the evidence you hold, a named owner, and a state that allows “unresolved”. Build it before you price anything. Below is the empty template, then seven rows worked from two retained solicitations.
This page is about the matrix a pursuit team keeps. The customer responsibility matrix is a different document, the split of security responsibilities between a cloud provider and its customer, and the two shouldn’t be merged.
The free pursuit review workbook connects a source register to the requirements review, task estimates and decision handoff. Start with the completed fictional case, then use the four blank tabs for your own pursuit.
What the matrix decides, and what it can’t
It tells you which conditions you can support today, which need work, which you can’t read yet, and who owns each. It doesn’t certify eligibility. The contracting officer sets the requirement, your company decides whether to bid, and an assessor or the government decides whether a status is met.
The template
| Column | What goes in it |
|---|---|
| ID | Short row ID you’ll reuse in the checklist and the change log |
| Source | Public URL or solicitation identifier |
| Document, version, date | The file and version the row came from |
| Locator | Page, section, paragraph |
| Source text | Verbatim quote, or a bounded reference marked “paraphrase” |
| Interpretation | What you understand it to require of you |
| Category | Access, export control, CUI, CMMC/NIST, source approval, quality, delivery, registration, other |
| Checkpoint | Access, participation, submission, award, performance |
| Applicability assumption | Why this row applies to your planned scope |
| Evidence reference | Where the supporting evidence is, with its date |
| State | Supported, gap, unresolved, not applicable (with reason) |
| Owner | A named person |
| Next action and due | What moves the state, by when |
| Decision impact | Disqualifying, resolvable, or informational |
| Last reviewed | Date and solicitation version |
Fifteen columns looks like a lot. In practice five of them are filled once per solicitation and copied down. The columns that earn their place are Source text, Interpretation, Checkpoint, Evidence reference and State.
Seven worked rows
Two solicitations, labeled separately. They’re separate procurements, and nothing below combines them.
Navy RFQ N6833526Q1186, NAVAIR Warfare Center Aircraft Division, issued 25 Aug 2026, retained copy of 37 pages.
| ID | Locator | Source text | Interpretation | Category | Checkpoint | Evidence reference | State | Decision impact |
|---|---|---|---|---|---|---|---|---|
| H-1 | p.2, Section A | ”All requesting Offerors must have a current certified DD2345 to obtain the drawings. Drawings will be provided to your designated data custodian on your certified DD2345 via the DoD Safe website.” | A current JCP certification with the right custodian named is a precondition for reading the package. | Export control, access | Access | DD 2345 on file, expiry date, custodian name | (yours) | Disqualifying if missed, see H-3 |
| H-2 | pp.2–3, CMMC para (d) | “Access will be granted only to entities that demonstrate: 1) Current and valid CMMC Level [2(Self)]; and 2) Compliance with applicable safeguarding requirements; and 3) Valid DD Form 2345.” | The cyber status is checked before release, in SPRS, per para (e). | CMMC/NIST, access | Access | SPRS entry, CMMC UID, assessment date | (yours) | Disqualifying if missed |
| H-3 | pp.2–3, paras (c), (k), (l) | “(c) … must possess a current and valid CMMC Level [2] certification at the time of contract award.” “(l) Failure to obtain the CUI drawing package will render the Offeror ineligible for award.” | Two award-stage conditions. Para (c) says “certification”, para (d) says “Level 2 (Self)”. The assessment type at award is not settled by the text. | CMMC/NIST | Award | Same as H-2 plus the clarification answer | Unresolved until the contracting officer answers | Disqualifying |
| H-4 | p.2, Section A | ”All Offerors, other than the successful Offeror, are required to destroy all export control data … Offerors shall provide proof of such destruction via signed letter on corporate letterhead”. | An obligation that applies if you lose. Needs a process and an owner before you request the package. | Export control | Performance (post-decision) | Destruction procedure, letter template | (yours) | Informational, but binding |
| H-5 | p.36, DFARS 252.204-7025(b)(1) | “The CMMC level required by this solicitation is: ____ [Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)].” | The provision’s blank is unfilled in this RFQ. Section A names a level; the provision doesn’t. A DLA Land Warren package from the same month fills the same blank with “CMMC Level 2 (Self)”. | CMMC/NIST | Award | Clarification answer | Unresolved until the contracting officer answers | Disqualifying |
DLA Aviation RFP SPRWA1-26-R-0017, Warner Robins, notice text posted 4 Aug 2026 and updated 24 Aug 2026.
| ID | Locator | Source text | Interpretation | Category | Checkpoint | Evidence reference | State | Decision impact |
|---|---|---|---|---|---|---|---|---|
| F-1 | Notice text, acquisition strategy | ”This part requires engineering source approval by the design control activity in order to maintain the quality of part. … Pre-qualified, but unapproved, sources will be required to produce First Articles.” | Technical approval is a participation condition separate from any cyber status. | Source approval | Participation | Approval letter, or qualification plan and timeline | (yours) | Disqualifying without approval or a qualification path |
| F-2 | Notice text, CMMC clarification | ”While an active assessment is not required at the exact moment of the proposal submission, the selected awardee must have the required level active and verified in the Supplier Performance Risk System (SPRS) at the time of contract award.” | The buyer’s own timing statement: award, not submission. Contrast with H-2, where the check is at access. | CMMC/NIST | Award | SPRS entry, assessment date | (yours) | Disqualifying at award |
Read H-2 and F-2 side by side. Same status, two different checkpoints, two different amounts of time to fix a gap. A matrix that only records where a requirement goes in the proposal never shows you that.
Keep source text, interpretation and evidence apart
Rows H-3 and H-5 are the reason. Paragraph (c) of the Hellfire RFQ says “CMMC Level [2] certification” at award. Paragraph (d) says “CMMC Level [2(Self)]” for access. And on page 36 the DFARS 252.204-7025 provision, which is where the level is supposed to be stated, has its blank unfilled. If you write one interpretation and drop the quotes, you’ve decided the question the solicitation left open. Keep both quotes in the Source text column, write the ambiguity in Interpretation, mark the state unresolved, and send the question.
The Evidence reference column is the third thing that shouldn’t blur. “We have Level 2” is an interpretation. “SPRS entry dated 14 Jul 2026, CMMC UID xxxx, self-assessment” is evidence.
States and unknowns
- Supported. Evidence exists, is current, and matches the checkpoint.
- Gap. The condition is clear and you don’t meet it. Owner, action, due date.
- Unresolved. The text is ambiguous, two documents conflict, or an attachment is missing. Owner, route, question.
- Not applicable. With a written reason tied to your planned scope.
When two documents conflict, record both locators in one row and leave the state unresolved. When evidence exists but you haven’t obtained it (a prime’s letter, a subcontractor’s affirmation), the state is gap, and the next action is the request.
Review cadence and amendments
Review the matrix at every posting in the solicitation family and at every Q&A. On 24 Aug 2026 the F-16 buyer posted three new answers, one of them on subcontractor flowdown, and issued Amendment 01 in the same update. The answer adds a row. The amendment’s own contents are a separate read. The amendment review checklist shows how to log the change without losing the earlier version.
Date every review against the solicitation version. A matrix reviewed against the 4 Aug posting is a different record from one reviewed against 24 Aug.
Hand the record on
The matrix feeds two places. The bid eligibility checklist takes the disqualifying and unresolved rows into the go/no-go decision. After award, the performance-checkpoint rows move into contract obligations, where the same requirement, owner and evidence carry on.
Where Deep Fathom fits
Use this worksheet to identify the security requirements and evidence work your team needs to manage. Deep Fathom’s current platform scope includes evidence management, obligation-to-work traceability and CMMC/NIST SP 800-171 workflows. Bring a specific row to a platform evaluation so our team can show the applicable workflow. Your pursuit team maintains this procurement worksheet and its version history.
Your company decides whether to bid. The contracting officer establishes the solicitation requirement.
See how requirements, owners and evidence relate. Send our team the solicitation number or the requirement you’re working from, and we’ll demonstrate the relevant compliance evidence workflow. Review bid requirements
Related reading
Read why a requirement can still have no owner and the four-checkpoint case comparison.