Supply Chain Risk Management & NIST SP 800-171 Compliance

The contract requires the implementation of NIST SP 800-171 controls to safeguard Controlled Unclassified Information and ensure full compliance with DFARS 252.239-7018 regarding supply chain risk mitigation. This subcontract mandates adherence to specific cybersecurity standards designed to protect CUI across all systems and processes, with an explicit focus on identifying, assessing, and reducing risks introduced through third-party vendors and external partners. The work involves establishing, documenting, and maintaining robust security practices aligned with federal guidelines, including continuous monitoring, access controls, incident response, and audit capabilities to meet defense department expectations. Performed under the direction of the Defense Logistics Agency within the Department of Defense, this effort is governed by NAICS code 541512, indicative of computer systems design and related services. The performance location and point of contact details are unspecified, but the contractual obligations apply universally across all workstreams involving CUI handling. Compliance is non-negotiable and must be sustained throughout the contract lifecycle, with potential evaluation of control effectiveness through audits or assessments. Failure to meet these requirements could result in contract termination, financial penalties, or loss of eligibility for future defense-related work.