Cybersecurity Compliance for Covered Defense Information (CUI)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information within contractor information systems. This includes the development and continuous updating of a System Security Plan and a Plan of Action and Milestones to document control implementation status, as well as timely reporting of any security incidents that may compromise CUI. The scope is focused on ensuring compliance with federal cybersecurity standards for protected data handled by subcontractors supporting defense-related medical supply chain operations. The contract is classified as a subcontract under NAICS code 541512, issued by the Department of Defense through the Medical Supply Chain MD Surg FSF organizational unit. Bids must be submitted by the deadline of July 27, 2026, and all work is expected to align with Defense Federal Acquisition Regulation Supplement requirements for protecting sensitive government information. Performance will be conducted under the oversight of the DoD, with no specific geographic location designated for performance, indicating potential remote or distributed operations. Compliance with these cybersecurity requirements is mandatory for contract award and continued performance.