Cybersecurity Compliance (NIST SP 800-171)

The contract requires suppliers to ensure their information systems comply with NIST SP 800-171 standards to safeguard controlled unclassified information as mandated by DFARS 252.240-7997. This obligation applies to all subcontractors working under the Defense Logistics Agency and applies to systems handling or processing CUI, with full implementation expected to meet federal cybersecurity requirements. The subcontract is linked to the DLA’s broader cybersecurity framework and mandates continuous adherence to the NIST controls throughout the contract period. The contract was posted on June 25, 2026, and falls under NAICS code 541512, which pertains to computer systems design services. It is classified as a subcontract with no set-aside designation, meaning it is open to all qualified vendors regardless of business size or status. Performance may occur across any location, as no specific place of performance is defined, and the agreement is administered through the Department of Defense. Compliance is mandatory and subject to verification, with failure to meet NIST SP 800-171 requirements potentially leading to contract termination or financial penalties.