Cybersecurity and Covered Contractor Information Systems (Basic Safeguarding)

The contract requires implementation of basic safeguarding measures for contractor information systems that handle controlled unclassified information, in alignment with NIST Special Publication 800-171 and Federal Acquisition Regulation clause 52.240-93. This subcontract mandates the establishment of foundational cybersecurity protections to ensure the confidentiality, integrity, and availability of CUI processed, stored, or transmitted on contractor systems, focusing on essential controls outlined in the NIST framework without requiring full compliance with more advanced or expanded security requirements. The effort is scoped specifically to meet the baseline standards for covered contractor information systems as defined under current federal guidance. The solicitation is issued under the Medical Supply Chain MD Surg FSF, a Department of Defense activity, with performance expected to occur in Everett, Washington, 98207-2600. It falls under NAICS code 541512 for computer systems design services and is categorized as a subcontract with no specific set-aside designation. The proposal must be submitted by July 20, 2026, and all parties must ensure their information systems meet the required safeguards prior to handling any CUI, with continuous adherence to the established security protocols throughout the contract period. Failure to comply with NIST SP 800-171 and FAR 52.240-93 may result in contract termination or other enforcement actions.