Cybersecurity Compliance Flow-Down to Sub-Tier Suppliers

The contract requires the prime contractor to ensure all sub-tier suppliers comply with NIST SP 800-171 cybersecurity requirements by collecting System Security Plans, validating that all required controls are implemented and properly documented, and granting the U.S. government access to conduct assessments as mandated by DFARS clauses. This obligation extends throughout the supply chain, making the prime responsible for enforcing compliance regardless of the supplier's tier or location. The goal is to protect controlled unclassified information flowing through subcontractors and maintain the integrity of defense-related systems. The solicitation is issued under the NAICS code 541611 for management consulting services, with performance occurring in Jacksonville, Florida, and tied to the Department of Defense’s Land Supply Chain. The contract is structured as a subcontract and requires responses by May 22, 2026, with the solicitation posted on May 11, 2026. There is no set-aside designation, and the prime contractor must establish mechanisms to monitor, validate, and report sub-tier compliance without delay to meet government assessment deadlines and regulatory standards.