Cybersecurity Compliance and CUI Protection

The contract requires full implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information across all systems and processes, ensuring compliance with federal cybersecurity standards. This includes establishing, documenting, and maintaining the necessary technical, administrative, and physical safeguards to prevent unauthorized access, disclosure, or loss of CUI. A Basic Assessment must be conducted to evaluate the effectiveness of implemented controls and verify alignment with NIST requirements, with findings rigorously documented and available for review. The contractor is obligated to report any cyber incident involving CUI within 72 hours of discovery, following established Department of Defense protocols for incident response and notification. Performance obligations extend to all operational environments, with the primary place of performance located in APO, ZIP 09227-0000. This is a subcontract under NAICS code 541512, issued by the Department of Defense’s Medical Supply Chain MD Surg FSF, with responses due by May 18, 2026. All activities must be executed in strict adherence to federal cybersecurity directives and defense contracting requirements.