Northrop Grumman CTM-P-ST-002 — U.S. Government FFP or T&M Order for Commercial Products and Services

Its 69 clauses can ask you for 131 things.

1. A program you have to be running19e.g. Fifteen named controls running on any system of yours that holds or carries the buyer's contract information 52.204-21(b)(1)

   You are either running it or you are not, and what the prime asks for is the date it started.

   • An ethics awareness and training program, and an internal control system with a reporting channel such as a hotline that an employee can use anonymously

     Owed within 90 days of award, unless you represented yourself as a small business concern for this award or the contract is for a commercial product or commercial service — (c) opens by excluding both

     FAR 52.203-13(c)

   • The security program the operating manual at 32 CFR part 117 requires — a facility security officer, cleared people, storage, marking, transmission and reporting

     Owed when the same access (a) limits the clause to, and it follows any revision of the manual you are given notice of

     52.204-2(b)(1)

   • Fifteen named controls running on any system of yours that holds or carries the buyer's contract information — access limits, authentication, media sanitization, boundary protection, timely patching and malware scanning

     Owed when federal contract information — information not intended for public release, provided by or generated for the Government under the order — resides in or transits your own system

     52.204-21(b)(1)

   Show 12 moreShow fewer

   • Scheduling that puts the rated order ahead of unrated work, and rated orders of your own placed on the suppliers of what it needs

     FAR 52.211-15

   • A listing practice, running for the life of the contract: every employment opening listed immediately with the appropriate employment service delivery system, and at least concurrently with any other recruitment source or effort you use

     41 CFR 60-300.5(a)(2) and (a)(3), which FAR 52.222-35(b) makes a term of your contract

   • Paid sick leave for everyone working on or in connection with the contract, earned at not less than one hour for every 30 hours worked, up to the 56-hour annual cap

     FAR 52.222-62(c)(1)

   • Initial and annual role-based privacy training, with a test of what was learned

     Owed when an employee will have access to a system of records, handle personally identifiable information, or design, develop, maintain or operate a system of records

     52.224-3(b)

   • A private security operation run to 32 CFR part 159 — personnel registered and managed, weapons authorized and accounted for, armored vehicles registered, incidents reported

     FAR 52.225-26(c)(1)

   • A system of internal controls that manages the Government property in your shop — control, use, preservation, protection, repair and maintenance

     FAR 52.245-1(b)(1)

   • An inspection system acceptable to the Government, covering the supplies under this contract, with only inspected and conforming supplies tendered for acceptance

     FAR 52.246-2(b)

   • The NIST SP 800-171 security requirements, in the version in effect when the solicitation was issued, running on every system of yours that holds or moves the covered information

     Owed when the system is your own — (b)(1) sends an information technology service operated on the Government's behalf to the contract's own terms instead

     252.204-7012(b)(2)(i)

   • A marking process and the equipment behind it, putting a MIL-STD-130 data matrix and human-readable text on every item the contract calls out

     DFARS 252.211-7003(c)

   • A marking process putting the Government's own serial number on each major end item, in the place and by the method the contract's technical instructions name

     DFARS 252.211-7008(b)

   • Access controls that keep controlled technical data away from foreign persons, your own foreign employees included, and a license for anything that leaves the country

     DFARS 252.225-7048(b)

   • Administrative, technical and physical safeguards at the level the DoD Cloud Computing Security Requirements Guide sets

     Owed when cloud computing is used to provide information technology services in performing the order, unless the contracting officer notifies you that the DoD Chief Information Officer has waived it

     252.239-7010(b)(2)

   and 4 more, each on its clause's page

2. Something somebody else has to issue you12e.g. Mill certificates giving the country of melt for every specialty metal incorporated in the item DFARS 252.225-7009

   The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.

   • A declaration carrying the certification and disclosure at 52.203-11(c) and (d), obtained from each person requesting or receiving the subcontract and retained by whoever awards it

     Owed where the subcontract exceeds the threshold specified in FAR 3.808 on the date of subcontract award — the clause names no figure, and 3.808 sets it at $200,000 since 2025-10-01

     FAR 52.203-12(g)(1)

   • A legible copy of the carrier's rated on-board ocean bill of lading, to the contracting officer and to the Maritime Administration

     Owed when contract cargo has moved by sea — 20 working days from the date of loading in the United States, 30 working days from a foreign port

     FAR 52.247-64(c)

   • Level I antiterrorism awareness training completed for each person needing routine access, within 30 days of needing it and once a year after that

     Owed for each of your people whose work needs routine physical access to a federally controlled facility or military installation

     DFARS 252.204-7004(b)

   Show 9 moreShow fewer

   • A DoD-approved medium assurance certificate, bought from an outside certificate authority

     Owed when an incident has to be reported — the certificate is what the reporting channel authenticates against, so it is held before the incident rather than obtained after it

     252.204-7012(c)(3)

   • A cloud service provider meeting security requirements equivalent to the FedRAMP Moderate baseline, and complying with (c) through (g) on reporting and forensics

     Owed when covered information sits on a cloud service you did not build — the paragraph reaches an external provider only

     252.204-7012(b)(2)(ii)(D)

   • The contracting officer's written consent, given before any litigation information goes to an entity outside your organization

     DFARS 252.204-7014(b)(2)

   • The same completed assessment from each of your own suppliers, before anything is awarded to them

     Owed when you place a subcontract of your own that is subject to NIST SP 800-171 under 252.204-7012

     252.204-7020(g)(2)

   • An assessment by an accredited third-party assessment organization

     Owed when the value written at (d)(1)(i) is CMMC Level 2 (C3PAO). At CMMC Level 1 (Self) or Level 2 (Self) no outside assessor is owed, and Level 3 (DIBCAC) is assessed by the Government

     252.204-7021(d)(1)(i)

   • An affirmation of continuous compliance from each of your own suppliers, and a current certificate or status at the level their work calls for

     Owed when you award a subcontract of your own that will process, store or transmit the information — both are due before that award rather than after it

     252.204-7021(d)(4) and (f)(2)

   • Mill certificates giving the country of melt for every specialty metal incorporated in the item, gathered back through the bill of material — evidence the prime weighs, not paper the clause names

     DFARS 252.225-7009

   • A license from the owner of any copyrighted material built into a deliverable, obtained for the Government, plus written approval and a statement of the license on the transmittal

     Owed when copyrighted material you do not own is going into technical data you will deliver

     252.227-7013(e)

   • A license from the owner of any copyrighted software or documentation you did not write, obtained for the Government before delivery

     Owed when third-party copyrighted software or documentation is going into what you will deliver

     252.227-7014(e)
3. A state you have to be in, in a government system9e.g. A current CMMC status at the level written into the order 252.204-7021(d)(1)(i)

   The record has to be posted before the prime can see it, and posting is not the same day as being ready.

   • A facility clearance under the National Industrial Security Program, carried by a signed DD Form 441 security agreement

     Owed when the order actually involves access to information classified Confidential, Secret or Top Secret — paragraph (a) limits the clause to that extent

     52.204-2(b)(1)

   • An assessment of your covered systems completed inside the last three years, with the summary level scores posted in the Supplier Performance Risk System

     Owed when the subcontract is subject to NIST SP 800-171 under 252.204-7012 — (g)(2) bars the tier above from awarding until the assessment is done, and (g)(3) is the route to get the score posted

     252.204-7020(g)(2) and (g)(3)

   • A current CMMC status at the level written into the order, or higher, held for the life of the work

     Owed when for every information system used on the work that processes, stores or transmits the information — the level is the value the contracting officer wrote into the blank at (d)(1)(i)

     252.204-7021(d)(1)(i)

   Show 6 moreShow fewer

   • An affirmation of continuous compliance, completed each year in the Supplier Performance Risk System by a named affirming official

     Owed when for each CMMC identifier covering a system used on the work, and it has to be current rather than merely on file

     252.204-7021(d)(3)

   • The results of a current self-assessment entered in that same system

     Owed when each CMMC identifier not covered by a C3PAO assessment or a DIBCAC assessment

     252.204-7021(e)(2)

   • An account in the Government's electronic submission system, with each item's record posted through it into the item unique identification registry

     DFARS 252.211-7003(f)

   • That serial number registered against the item's unique identifier at the time of delivery, in the registry the contract routes it to

     DFARS 252.211-7008(c)

   • Registration with the Department of State under the ITAR, which the clause names in its own words, for a shop that manufactures or exports defense articles

     DFARS 252.225-7048(b)

   • A new identifier assigned, marked and registered in the IUID Registry

     Owed when an item is found already marked but not registered, and the (d)(1) conditions are met

     DFARS 252.245-7005(d)(4)
4. Something you write50e.g. A written code of business ethics and conduct FAR 52.203-13(b)(1)

   Days to weeks, and nobody outside your company has to agree to it.

   • A written code of business ethics and conduct, made available to each employee engaged in performance, within 30 days of award

     FAR 52.203-13(b)(1)

   • A written disclosure to the agency Inspector General, copy to the contracting officer

     Owed on credible evidence that a principal, employee, agent or subcontractor committed fraud, bribery, a gratuity or conflict of interest violation, or a civil False Claims Act violation

     FAR 52.203-13(b)(3)(i)

   • A posted notice of employee whistleblower rights under section 1553 of the 2009 Recovery Act

     Owed where Recovery Act money funds the work — (b) carries the clause only into subcontracts funded in whole or in part with those funds

     FAR 52.203-15(a)

   Show 12 moreShow fewer

   • A written notice to employees, in the predominant language of the workforce, of their whistleblower rights under 41 U.S.C. 4712

     FAR 52.203-17(b)

   • A written notice to current employees and suppliers that existing confidentiality terms blocking a report of waste, fraud or abuse are no longer in effect

     Owed where agreements or statements signed before this contract carry prohibitions inconsistent with (b)

     FAR 52.203-19(c)

   • The notices in the form the Director prescribes, posted in conspicuous places available to employees and applicants for employment

     41 CFR 60-300.5(a)(9), which FAR 52.222-35(b) makes a term of your contract

   • Notice to each labor organization or representative of workers that you are bound by the terms of the veterans' statute

     Owed when you have a collective bargaining agreement or other contract or understanding with a labor organization or representative of workers

     41 CFR 60-300.5(a)(10), which FAR 52.222-35(b) makes a term of your contract

   • The Department of Labor notice of employee rights under the National Labor Relations Act, posted where you post other notices to employees, in the languages your workforce reads

     FAR 52.222-40(b)

   • A compliance plan sized to the work — awareness programming, a reporting route to the hotline at 1-844-888-FREE, recruitment and wage procedures that charge workers no fees, housing that meets host-country standards, and procedures to keep agents and lower-tier suppliers out of the prohibited activity

     Owed when more than $700,000 of the work is supplies other than commercially available off-the-shelf items acquired outside the United States, or services performed outside the United States

     FAR 52.222-50(h)

   • Notice to your employees and agents of the prohibited activities and of what a violation costs

     FAR 52.222-50(c)(1)

   • Notice to every worker performing on or in connection with the contract of the applicable Executive Order minimum wage rate, posted or delivered electronically

     FAR 52.222-55(d)

   • Payroll records for each worker — name, address, social security number, classification, rate, hours worked, deductions and wages paid — made and kept for three years after the work is finished

     FAR 52.222-55(e)(1)

   • The leave records paragraph (i) enumerates, among them a copy of each notice telling an employee how much paid sick leave has accrued

     FAR 52.222-62(i)(1)(vii)

   • Written notice that the validity of the clause has been put in issue

     Owed when a lower-tier supplier sues you and the suit puts the clause's validity at issue

     FAR 52.222-90(b)

   • The completion records for that training

     Owed when the contracting officer requests them

     52.224-3(d)

   and 35 more, each on its clause's page

5. Something you fill in and send back21e.g. A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident 252.204-7012(c)(1)(ii)

   Hours, once you know which one is missing.

   • Standard Form LLL naming the lobbying registrants, including the individuals performing the services

     Owed when no form went in with the offer and a registrant has since made a lobbying contact for you on this contract

     FAR 52.203-12(d)(1)

   • An updated Standard Form LLL to the contracting officer, within 30 days of the end of the calendar quarter the change fell in

     Owed where a form was already filed under 52.203-11(d) and a change affects Block 10 of it — the name and address of the registrant, or the individuals performing the services

     FAR 52.203-12(d)(2)

   • A report — contract number, supplier, brand, model number and item description — with mitigation detail and the prevention steps taken and planned within 10 business days after it

     Owed when you identify a Kaspersky Lab covered article in what you supply or use — the first report is due within three business days of that

     FAR 52.204-23(c)

   Show 12 moreShow fewer

   • A report — contract number, supplier, brand, model number, item description and any mitigation already under way — with further detail and prevention steps within 10 business days after it

     Owed when you identify covered telecommunications equipment or services in what you supply or use — the first report is due within one business day of that

     FAR 52.204-25(d)

   • A report — contract number, product or service name, the covered article or the source, the vendor, brand, model number and item description — with mitigation detail and prevention steps within 10 business days after it

     Owed when you identify a covered article or a prohibited source in what you furnish or will furnish — the first report is due within three business days of that

     FAR 52.204-30(c)(3)

   • A written acceptance or rejection of the rated order, back to the customer inside the window the priorities regulation sets and on the grounds it allows

     FAR 52.211-15

   • The VETS-4212 report to the Department of Labor each year by September 30 — protected veterans by category and location, total new hires, and how many of those were protected veterans

     FAR 52.222-37(b)

   • A certification to the buyer, at award and once a year after that, that the plan is implemented and that after due diligence nothing prohibited was found — or that remedial and referral action was taken

     Owed when the same $700,000 outside-the-United-States portion that brings the plan with it

     FAR 52.222-50(h)(5)

   • An immediate report to the buyer and to the agency inspector general, naming the action taken against whoever was responsible

     Owed when you receive credible information that an employee, agent or subcontractor has engaged in the prohibited conduct

     FAR 52.222-50(d)(1)

   • The information and reports the buyer asks for to establish compliance, including access to books, records and accounts

     Owed when the contracting officer requires them

     FAR 52.222-90(b)(2)

   • A report of a lower-tier supplier's conduct that may breach the clause, and the remedial action you are directed to take

     Owed when the conduct is known to you or reasonably knowable

     FAR 52.222-90(b)

   • The shipping documents annotated for the port of entry, carrying the tariff-schedule notation and the instructions to release the shipment and notify the contract administration office

     FAR 52.225-8(g)

   • A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident

     Owed when an incident affecting a covered system, the covered information on it, or your ability to perform the order is discovered

     252.204-7012(c)(1)(ii)

   • A report — contract and order numbers, supplier, brand, model number, item description and whatever mitigation exists — followed within 30 business days by what else was done to mitigate and to prevent it recurring

     Owed when you identify, or are notified of, covered defense telecommunications equipment or services in what you supply or use — the first report is due within three business days of that

     DFARS 252.204-7018(d)

   • The customs entry forms, completed and submitted to the District Director of Customs with a copy to the DCMA St. Louis Duty Free Entry Team, which executes the duty-free entry certificates

     Owed when the shipment is not consigned directly to a military installation — those are released under sections 10.101 and 10.102 of the Customs regulations instead

     DFARS 252.225-7013(f)(1)(i)

   and 6 more, each on its clause's page

6. Nothing to send now20They are terms that decide what money moves later, rules you follow while you work or numbers with no text behind them.