Cybersecurity Compliance and Incident Reporting

The contract requires implementation of NIST Special Publication 800-171 security controls to safeguard covered defense information processed, stored, or transmitted on systems associated with the task. Compliance with these controls is mandatory to ensure the confidentiality, integrity, and availability of sensitive data related to the Medical Supply Chain MD Surg FSF program. Contractors must also establish and maintain a robust cyber incident reporting capability to promptly detect, respond to, and report any security incidents involving covered defense information in accordance with federal requirements. This subcontract is issued under NAICS code 541512, indicating it relates to computer systems design services, and is intended for performance at the FPO location with a ZIP code of 96666. The solicitation was posted on July 15, 2026, with a response deadline of July 21, 2026. The contracting activity falls under the Department of Defense, and the work is subject to all applicable federal cybersecurity regulations governing defense subcontractors handling controlled unclassified information. Full compliance with reporting timelines and control implementation is essential for contract fulfillment.