Cybersecurity Safeguarding for Non-IT Suppliers

The contract requires implementation of NIST SP 800-171 basic safeguarding controls on information systems used by non-IT suppliers handling federal contract information, ensuring compliance with cybersecurity requirements mandated for protection of sensitive data. This subcontract falls under NAICS code 541512 and is issued by the Department of Defense’s Strategic Acquisition Program Directorate, emphasizing the need for consistent security practices across the supply chain regardless of the supplier’s primary business function. The solicitation is open for responses until August 18, 2026, with all systems in scope expected to meet the minimum baseline of safeguards outlined in NIST SP 800-171 to protect federal contract information from unauthorized access, disclosure, or compromise. All participating suppliers must adhere to the specified cybersecurity framework without exception, and the performance of required controls is mandatory for continued eligibility under this contractual arrangement. While no specific geographic location is designated for performance, the contractual obligations apply wherever contractor information systems process or store federal contract information. The solicitation is not set aside for any particular small business category or minority-owned entity, making it broadly accessible to qualified subcontractors who can demonstrate their ability to implement and sustain the required NIST controls. Participation requires full understanding of the control environment and documented readiness to meet federal cybersecurity standards as a condition of award and ongoing performance.