Sub-tier Supplier Cybersecurity Compliance Management

The contract requires the successful offeror to manage cybersecurity compliance across all sub-tier suppliers by ensuring each has completed a Basic NIST SP 800-171 assessment within the last three years. The responsibility includes collecting validation documentation, verifying the accuracy and timeliness of assessments, and submitting aggregated compliance data to the Supplier Performance Risk System. This effort is critical to maintaining the security posture of the Department of Defense supply chain and aligning with federal cybersecurity standards for contractors handling controlled unclassified information. The contract falls under NAICS code 541611 and is issued by the ASC Commodities Division under the Department of Defense, with performance centered in New Cumberland, Pennsylvania, zip code 17070-5002. Solicitation opens on May 10, 2026, and responses are due by May 18, 2026. The offeror must be prepared to demonstrate a systematic, auditable process for tracking and reporting supplier compliance and must operate in full alignment with federal requirements governing subcontractor cybersecurity obligations.