Supplier Cybersecurity Compliance Verification for Sub-tier Suppliers

The contract requires verification that all subcontractors and suppliers handling Controlled Unclassified Information adhere to the security controls outlined in NIST SP 800-171. This involves systematically collecting System Security Plan Rating System scores from these third parties, validating the accuracy and completeness of their self-assessments, and ensuring all documentation is maintained in an audit-ready state. The focus is on end-to-end compliance across the supply chain to protect CUI transmitted to or processed by sub-tier entities. The work is tied to the Department of Defense’s ASC Commodities Division and is performance-based at Tinker Air Force Base with a zip code of 73145-8000. The solicitation, issued under NAICS code 541611 for management consulting services, is limited to subcontractors and does not specify a set-aside classification. Interested parties must submit responses by May 18, 2026, with all compliance activities expected to be executed with precision to meet federal cybersecurity standards and maintain unbroken chain of custody for CUI documentation.