Cybersecurity Compliance and SPRS Reporting

The contract requires implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) across all relevant systems and processes, ensuring compliance with federal cybersecurity standards for handling sensitive but unclassified data. Performance must include maintaining documented evidence of control implementation, conducting ongoing assessments, and resolving any identified gaps to meet the required security posture. A critical component of the deliverables is the submission of accurate and timely cybersecurity assessment scores through the Supplier Performance Risk System (SPRS), which will be used to evaluate and monitor the contractor’s compliance status with DoD requirements. This subcontract is issued by the ASC Commodity Division under the Department of Defense with a place of performance at Robins Air Force Base, Georgia, 31098-1887. It falls under NAICS code 541512 for computer systems design services and carries a response deadline of May 21, 2026. The contractor is expected to execute all cybersecurity activities in alignment with DoD expectations, with full accountability for adherence to NIST guidelines and the accurate reporting of SPRS scores. Failure to meet these obligations may result in contract non-compliance, performance penalties, or termination.