Supply Chain Risk and Cybersecurity Compliance (NIST SP 800-171)

The contract requires the implementation and assessment of compliance with NIST Special Publication 800-171 to ensure the protection of controlled unclassified information within contractor systems. This effort is focused on establishing and maintaining robust cybersecurity controls aligned with federal standards to safeguard CUI handled by subcontractors supporting the Defense Logistics Agency under the Department of Defense. The scope includes full adherence to the 110 security requirements outlined in NIST SP 800-171, covering areas such as access control, awareness and training, audit and accountability, configuration management, identification and authentication, and incident response, among others. The subcontract is classified under NAICS code 541512, indicating it pertains to computer systems design and related services, and is positioned to support DLA’s broader supply chain risk and cybersecurity initiatives. Performance is expected to take place across locations as determined by the contractor’s operational footprint, with no specific geographic restrictions defined. The contract was posted in July 2026 and is part of the Defense Logistics Agency’s ongoing efforts to enforce cybersecurity compliance across its vendor network, ensuring that all entities handling CUI meet mandatory federal protection standards. Failure to achieve and sustain compliance may result in contract termination or suspension of performance.