Cybersecurity Compliance for CUI Handling (Subcontractor Flow-Down)

This contract requires subcontractors handling Controlled Unclassified Information to implement all NIST SP 800-171 security controls and establish ongoing compliance through the Supplier Performance Risk System reporting process, in accordance with DFARS 252.204-7012. All subcontractors must fully integrate the required cybersecurity measures into their systems and processes to safeguard CUI, ensuring alignment with federal standards for information protection. Compliance is mandatory and subject to verification by the Department of Defense through regular assessments and SPRS score submissions. The contract is issued under the NAICS code 541512 for the ASC Commodities Division and applies to work performed at the FPO location with zip code 96673. Subcontractors must respond to this solicitation by May 14, 2026, and are expected to demonstrate existing or planned capabilities to meet NIST 800-171 requirements, maintain audit-ready documentation, and sustain SPRS compliance throughout the performance period. Failure to implement controls or report accurately will result in noncompliance and potential termination of subcontracting arrangements.