Cybersecurity Compliance & NIST SP 800-171 Assessment

The contract requires the performance of a NIST SP 800-171 cybersecurity assessment to ensure the protection of Controlled Unclassified Information, with the objective of documenting all implemented security controls and achieving a validated compliance posture. The assessment must be completed and a summary score submitted to the Supplier Performance Risk System prior to delivery of any goods or services, ensuring alignment with federal requirements for safeguarding CUI. This subcontract is issued under the NAICS code 541611 and is tied to the Department of Defense’s Medical Supply Chain MD Surg FSF, with performance expected to occur in Johnston, Iowa, under a tight timeline with responses due by May 19, 2026. Compliance is mandatory for contract fulfillment, and failure to meet the assessment and reporting requirements will result in non-compliance with federal cybersecurity standards.