Subcontractor NIST Compliance Verification (Oversight and Coordination)

The contract requires verification that all subcontractors, excluding those providing only commercial off-the-shelf items, have current and valid NIST SP 800-171 Basic assessments on file along with corresponding SPRS scores, ensuring compliance with federal cybersecurity standards for controlled unclassified information. This oversight action is part of a broader effort to enforce cybersecurity posture across the supply chain under the Department of Defense’s subsistence logistics operations. The requirement applies to any subcontractor handling sensitive data related to defense supply functions, and documentation must be submitted before the response deadline to maintain contractual eligibility. The solicitation is issued under NAICS code 541611 for management consulting services and is scoped to the FPO area with a ZIP code of 09595, indicating a military postal address associated with overseas or expeditionary operations. The posting date falls in May 2026, with a short five-day window for responses, signaling an urgent compliance review cycle. While no set-aside designation is specified, the focus is strictly on enforcing existing NIST compliance requirements rather than expanding scope or altering terms. Contractors must ensure their subcontractors’ SPRS scores are up to date and properly documented in the Supply Chain Risk Management system to avoid delays or termination of subcontracts.