Cybersecurity and Covered Defense Information Safeguarding

The contract mandates the implementation of NIST SP 800-171 controls to protect covered defense information during any access or transmission of contract-related technical data or specifications. This requirement applies to subcontractors handling sensitive defense-related information and ensures compliance with federal cybersecurity standards designed to safeguard unclassified controlled technical information. The subcontract is issued under the Department of Defense through the Medical Supply Chain MD Surg FSF office, with performance expected at Fort Leonard Wood, Missouri, 65473-8952. The solicitation, posted on August 9, 2026, requires responses by August 17, 2026, and is classified under NAICS code 541512 for computer systems design services, indicating the technical nature of the work involved. All parties must adhere to the full suite of NIST SP 800-171 security controls, covering areas such as access control, audit, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, risk assessment, system and communications protection, and system and information integrity. Noncompliance may result in contract termination or financial penalties. The subcontractor is responsible for demonstrating and maintaining continuous compliance with these controls throughout the contract period, ensuring that any technical data, specifications, or systems accessed are protected against unauthorized disclosure, modification, or loss. The contract does not specify set-aside requirements and remains open to qualified entities capable of meeting the stringent cybersecurity obligations.