Cybersecurity Compliance (NIST SP 800-171) for Subcontractors

The contract requires subcontractors to conduct a cybersecurity compliance assessment in accordance with NIST SP 800-171 for all systems that handle Controlled Unclassified Information (CUI). The assessment must evaluate the implementation of security controls outlined in the standard and document the organization’s current posture regarding data protection, access controls, audit logging, and other required safeguards. The results of the assessment must be formally reported to the Supplier Performance Risk System (SPRS), ensuring transparency and accountability in the Department of Defense's supply chain cybersecurity framework. This requirement applies universally to all subcontractors within the procurement ecosystem, regardless of size or location, and failure to complete the assessment or submit findings may affect eligibility for continued performance under the contract. The solicitation is issued under the NAICS code 541611 for Management Consulting Services and is governed by the Subsistence FSE Supply Chain within the Department of Defense. The opportunity is open for response until May 4, 2026, with performance expected to occur at the FPO address with ZIP code 96666. Though no set-aside designation is specified, all responses must demonstrate compliance with federal cybersecurity standards, and subcontractors are expected to maintain documented evidence of adherence to NIST SP 800-171 requirements throughout the contract period. The assessment is not a one-time event but serves as a foundational element for ongoing compliance, with potential for future audits or updates to SPRS entries.