Cybersecurity Compliance for Covered Defense Information

The contract requires the implementation of NIST SP 800-171 security controls to safeguard covered defense information in alignment with DFARS 252.204-7012 regulatory requirements. This subcontract is part of a Department of Defense initiative managed by the Medical Supply Chain MD Surg FSF, focusing on ensuring robust cybersecurity posture across the supply chain. All entities awarded this contract must establish, maintain, and demonstrate compliance with the full suite of NIST controls designed to protect sensitive federal information processed, stored, or transmitted on nonfederal systems. Failure to meet these standards could result in contract noncompliance and termination. The opportunity is open for response until July 21, 2026, and is classified under NAICS code 541512 for computer systems design services. Although no set-aside designation is specified, the work is expected to be performed under the broader scope of defense cyber operations, with performance likely tied to systems handling classified or controlled unclassified information. Contractors must be prepared to provide documented evidence of control implementation, continuous monitoring, and incident reporting capabilities. The solicitation is accessible via the DIBBS portal, and interested parties are expected to confirm their ability to meet all DFARS and NIST compliance obligations prior to submission.