Cybersecurity Compliance for Subcontractors (NIST SP 800-171)

The contract requires subcontractors to implement and maintain all necessary security controls outlined in NIST SP 800-171 for any systems that handle Controlled Unclassified Information related to contract performance. These controls are mandatory to ensure the protection of sensitive data throughout the lifecycle of the work performed under the subcontract. Compliance is non-negotiable and must be fully operational by the time contract performance begins, with ongoing maintenance required to address evolving threats and regulatory updates. The systems in scope include all information technology infrastructure supporting the delivery of goods or services under the Medical Supply Chain MD Surg FSF initiative. The contract is classified as a subcontract under NAICS code 541512, indicating it involves computer systems design and related services, and is issued by the Department of Defense through its Medical Supply Chain program. Performance must occur at a location identified as FPO with ZIP code 96672-4090, which is a military postal address typically used for overseas or expeditionary operations. Responses to this solicitation are due by July 22, 2026, and bidders must demonstrate not only technical capability but also proven experience in achieving and sustaining NIST 800-171 compliance, including documentation, audits, and personnel training. Failure to meet these requirements may result in disqualification or contract termination.