Cybersecurity Compliance and SPRS Reporting

The contractor is required to implement all NIST SP 800-171 cybersecurity controls to protect covered defense information handled under this subcontract. This includes establishing, maintaining, and continuously monitoring a compliant security posture across all systems and processes that process, store, or transmit such information. Regular self-assessments must be conducted to evaluate adherence to each control, with findings documented and validated to ensure accuracy and completeness. All self-assessment scores must be submitted accurately and on time to the Supplier Performance Risk System, ensuring transparency and accountability in the Department of Defense’s supply chain risk management framework. This subcontract falls under the North American Industry Classification System code 541512, indicating it involves computer systems design and related services, and is issued through the Defense Logistics Agency under the Department of Defense. Performance is expected to meet federal cybersecurity standards without deviation, and non-compliance may impact eligibility for future contracts. Although specific geographic performance locations are not provided, the cybersecurity obligations apply to all operations related to this agreement regardless of location. Timely and precise reporting to SPRS is mandatory and directly affects the contractor’s risk profile within the defense industrial base.