Cybersecurity Compliance Implementation & SPRS Reporting

The contract requires implementation of NIST SP 800-171 Rev 1 security controls to safeguard Controlled Unclassified Information (CUI) within the scope of operations tied to the Department of Defense’s Medical Supply Chain FSH. This includes establishing, maintaining, and validating technical and procedural safeguards aligned with the NIST framework to ensure CUI is protected from unauthorized access, disclosure, or compromise. The contractor must conduct regular self-assessments of compliance with these controls and accurately document findings, ensuring all data is submitted to the Department of Defense’s Supplier Performance Risk System (SPRS) as a mandatory condition of contract adherence. Performance is tied to a specific location at Luke Air Force Base with a ZIP code of 85309-5300, and the work is classified as a subcontract under NAICS code 541512, which pertains to computer systems design services. The solicitation was posted on May 10, 2026, with responses due by May 18, 2026. Full compliance is required to meet DoD cybersecurity standards and maintain supply chain integrity, with failure to submit timely and accurate SPRS documentation potentially impacting contract standing and future procurement opportunities.