Cybersecurity Compliance for Controlled Unclassified Information (CUI)

The contract requires the implementation of NIST SP 800-171 security controls and full compliance with DFARS 252.204-7012 to safeguard Controlled Unclassified Information (CUI) within the subcontractor’s systems and processes. The work involves establishing, validating, and maintaining a cybersecurity posture that meets federal standards for protecting sensitive data handled by the Department of Defense, with ongoing reporting of System Security Plan Readiness Score (SPRS) to demonstrate compliance status. All activities must be performed in alignment with the specified requirements to ensure the secure handling, storage, and transmission of CUI, with emphasis on continuous monitoring and remediation of identified gaps. This subcontract is issued under NAICS code 541512 and is associated with the Medical Supply Chain Pharm FSA, operating under the Department of Defense. The place of performance is designated as FPO, ZIP 96667, with responses due by May 18, 2026. The contract is not subject to any set-aside provisions and is open to eligible subcontractors capable of meeting the stringent cybersecurity requirements outlined by federal regulations. The successful provider must be prepared to document all implementation efforts, maintain audit-ready records, and sustain compliance throughout the contract period, particularly as SPRS scores are critical for verification and continued performance under the agreement.