Subcontractor NIST Compliance Oversight

All subcontractors supporting this contract must maintain current NIST SP 800-171 assessments completed within the last three years to ensure continued compliance with federal cybersecurity requirements for controlled unclassified information. Failure to maintain up-to-date assessments will result in noncompliance and may lead to termination of subcontract obligations. The prime contractor is responsible for embedding this requirement into all subcontract agreements and actively monitoring adherence through regular audits and documentation reviews. Performance is tied to operations in Williamsburg, Virginia, with all subcontractors expected to align their security controls with the standards outlined in NIST SP 800-171 regardless of geographic location. The contract is issued under NAICS code 541611 for management consulting services and falls under the Department of Defense’s Medical Supply Chain program, with responses due by May 18, 2026.