NIST SP 800-171 Cybersecurity Compliance and SPRS Reporting

The contract requires full implementation of NIST SP 800-171 cybersecurity controls to safeguard Controlled Unclassified Information across all systems and processes. This includes conducting Basic Assessments to evaluate compliance, documenting results, and submitting those assessments to the Supplier Performance Risk System to maintain an accurate and current compliance posture. All aspects of CUI protection must be strictly enforced, covering storage, transmission, access controls, and incident response protocols. The requirement extends to subcontractors, who must be contractually bound to adhere to the same NIST SP 800-171 standards, ensuring that the flow-down of security obligations is comprehensive and enforceable throughout the supply chain. Compliance is not optional and must be continuously maintained to meet federal cybersecurity mandates.