Cybersecurity Compliance for Supplier Reporting

This contract requires strict adherence to NIST SP 800-171 and DFARS 252.204-7012 to ensure the proper safeguarding of controlled unclassified information across all IT systems and reporting functions performed by subcontractors. Compliance includes implementing security controls to protect sensitive data, conducting regular assessments of cybersecurity posture, and rapidly reporting any cyber incidents that may compromise the integrity, confidentiality, or availability of information. The obligation applies to all subcontractors involved in the supply chain supporting the Department of Defense’s Medical Supply Chain MD Surg FSF initiative, with specific emphasis on systems and processes handling controlled unclassified information. The contract is categorized as a subcontract under NAICS code 541512, with a performance location in Abilene, Kansas, 67410-2381. The solicitation was posted on July 30, 2026, and responses must be submitted by August 5, 2026. All parties must ensure their cybersecurity practices align with federal standards and that any non-compliance or incident is promptly escalated through established reporting channels. Failure to meet these requirements will result in contractual non-compliance and potential termination. The contract is open to qualified subcontractors operating under the Department of Defense’s procurement framework, with no set-aside provisions specified.