Buyer profile / NAVSUP WSS Mechanicsburg, 2026
At this Navy buying office, the CMMC provision arrived before the level did.
Your customer is rewriting its RFQ template right now, one contracting division at a time.
In the SAM.gov snapshot we captured on August 30, 2026, this office had 895 open solicitations and 418 carried the CMMC level notice provision, against 5.3 percent across all DoD offices. In almost every one, the field where the level goes is still empty.
Deep Fathom reads what is stated today, so the field filling in is not the first time you read it.
01 / What this means for your bids
It's a rollout, it's recent, and it isn't finished.
01.1
The provision is standard text, spreading by division
417 of the 418 flagged solicitations carry the same line, “NOTICE OF CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)”, next to first article approval and small business representations.
By posting month the share went 0 percent through May, 11 in June, 22 in July, 53 in August, and within August it runs 0 to 100 percent by contracting division. It looks like a template being updated, not item-by-item selection.
01.2
The level is usually not stated, and not just in the summary
412 of the 418 leave the level field empty. Six say Level 2, none says Level 1. We pulled the full solicitation text for 34 and the field is empty in 33 of them too.
A provision with an empty field states no level, and nobody can hold you to an unstated one. We won't tell you which level applies, and neither should anyone else. Ask the contracting officer, and expect the field to start filling in.
01.3
The clock and the drawings arrive together
Posted date to deadline runs a median of 30 days, middle half 28 to 32. This office is consistent.
And 166 of the 418 also reference DD Form 2345, the certification that gates export-controlled technical data. On those, you may need to be certified before you can read the drawings, let alone price the part.
Counts from the retained census, adoption, and award receipts over the hash-pinned snapshot. Plain-language terms per the DoD CMMC overview .
02 / How Deep Fathom helps
Get ready while the field is blank, not after it fills in.
An office that has added the provision to its template but not yet populated the level is an office that is going to populate it. When it does, the requirement lands in a 30-day window, often next to a DD Form 2345 gate. Reading the provision for the first time then is the expensive way to learn it.
- 01
Confirm the requirement and scope
Read the provision block and the package with us, and say plainly what is stated and what isn't.
- 02
See the readiness work
Map what's stated to your systems and the evidence you already hold, and turn the gaps into owned actions.
- 03
Collect evidence in context
Keep each artifact connected to its requirement, source, owner, and review history.
- 04
Review before each submission
A sequence that fits a 30-day window, or a plain statement that it doesn't.
03 / What the office's notices say
The provision, as this office posts it.
NOTICE OF CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL REQUIREMENTS (NOV 2025)
The CMMC level required by this solicitation is: [Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)]. This CMMC level, or higher (see 32 CFR part 170), is required prior to award for each contractor information system that will process, store, or transmit FCI or CUI during performance of the contract.
The title is followed, in 412 of 418 cases, by an empty level field. The provision behind it is DFARS 252.204-7025, quoted above at (b)(1). At (b)(2) it makes the offeror ineligible without a current CMMC status in SPRS at the level named in (b)(1) plus a current affirmation.
A blank (b)(1) names no level, and (b)(2)'s ineligibility attaches to the level (b)(1) names.
04 / The office record
What it buys, and who it buys from.
From the 418 flagged live notices, the top categories:
- By product code
- Electrical and electronic assemblies (5998), nonpowered valves (4820), packing and gasket materials (5330), hose and pipe fittings (4730). The award record lines up: valves and fittings lead there too, at 4,483 actions
- Award volume
- FY2024 through May 2026: 33,291 award actions to 1,432 distinct suppliers, $3.44 billion obligated. 711 suppliers received five or more actions, and the ten most frequent hold 20.6 percent, a broad base by DoD standards. This office buys from a lot of companies, often
- Set-asides
- 404 of the 418 flagged notices carry none, while 31 percent of FY2024 to May 2026 award actions were small business set-asides. Both numbers are true, and we don't know why they differ and won't guess
- What the award record means
- A supplier name in the award record means the office issued award actions to that company through May 2026. It says nothing about the company's compliance status or who wins next, and subcontract work doesn't appear in the record at all
| NAICS | What it is | Notices |
|---|---|---|
| 332919 | Metal valves and pipe fittings | 76 |
| 334412 | Bare printed circuit boards | 48 |
| 333998 | General purpose machinery | 42 |
| 339991 | Gaskets, packing, sealing devices | 30 |
| 335931 | Current-carrying wiring devices | 28 |
05 / Read this before acting on a profile
A profile describes the office, never a supplier, and never a requirement in force.
Every count is from the snapshot dated above and every award figure runs through May 2026.
No clause displayed is claimed operative, and no reader is claimed to fit any solicitation. The empty level field is the solicitation's statement, not ours, and the answer to “which level applies” belongs to the contracting officer.
The office next door already fills the field in: DLA Mechanicsburg states Level 1 (Self) in about half of its flagged notices. The record doesn't say whether this office will do the same. Ask.
Platform evaluation / This office's next RFQ
Get ready before the field fills in.
Tell us what you sell to this office, your CMMC status, and your open work. A Deep Fathom person reads it and names the first workflow to try.
Do not include CUI, credentials, export-controlled data, or any solicitation itself in this form.
Limitations
- Never “requires CMMC” for a blank-field notice. Never “incumbents”, only “suppliers with observed award actions”. Every number carries its snapshot date, and award figures say “through May 2026”.
- Adoption is observed history by month, never a forecast. The 46.7 against 5.3 comparison always states both numbers.
- No clause displayed is claimed operative. No supplier is described as needing, lacking, or holding any compliance status.
- Division codes are parsed from the notice contact line. 256 of 723 could not be parsed, so the parse runs at 71 percent.