Cybersecurity Compliance (NIST SP 800-171) for Suppliers

The contract requires defense suppliers to perform self-assessments and submit their compliance status through the Supplier Performance Risk System (SPRS) regarding adherence to the NIST SP 800-171 cybersecurity controls. These controls are essential for protecting Covered Defense Information (CDI) and ensuring the security of sensitive defense data throughout the supply chain. The contract is issued by the Department of Defense's Medical Supply Chain MD SURG FSF office and is classified as a subcontract under NAICS code 541512, indicating a focus on computer systems design and related services. Bidders must respond by May 18, 2026, for work to be performed in Groton, with the overarching goal of maintaining cybersecurity compliance aligned with federal defense regulations. This initiative reinforces the government's efforts to secure its defense-related information networks by requiring suppliers to verify and document their cybersecurity posture in line with established federal standards.