(c) In addition to the requirements at FAR 17.207(c), exercise an option only after:

(1) Determining that the contractor’s record in the System for Award Management database is active and the contractor’s unique entity identifier, Commercial and Government Entity (CAGE) code, name, and physical address are accurately reflected in the contract document. See PGI 217.207 for the requirement to perform cost or price analysis of spare parts prior to exercising any option for firm-fixed-price contracts containing spare parts.

(2) Verifying in the Supplier Performance Risk System (SPRS) ( https://www.sprs.csd.disa.mil/) that—

(i) The summary level score of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old, unless a lesser time is specified in the solicitation) for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order are posted (see 204.7303).

(ii) The contractor has a CMMC certificate at the level required by the contract, and that it is current (i.e., not more than 3 years old) (see 204.7502).