Subcontractor NIST Assessment Verification & Management

All subcontractors working on covered systems must have completed a Basic NIST SP 800-171 DoD Assessment within the prior three years, and documentation verifying this compliance must be provided and maintained. The contractor is responsible for ensuring that the DFARS 252.204-7012 clause is properly flowed down to all applicable subcontracts, thereby extending cybersecurity requirements to the entire supply chain. This requirement applies to subcontractors supporting systems that handle covered defense information and is mandatory for maintaining compliance with Department of Defense standards. The solicitation, issued by the Medical Supply Chain MD Surg FSF under the NAICS code 541612, is open for response until May 5, 2026, with performance expected to occur at APO, ZIP 96278-2060, and is categorized as a subcontract opportunity within the broader defense supply framework.