MFR - SPRS Nist - CO Signed.pdf

DEPARTMENT OF THE AIR FORCE

502D AIR BASE WING

JOINT BASE SAN ANTONIO

14 August 2025

MEMORANDUM FOR RECORD (MFR)

CONTRACT No.: FA301625Q6179

SUBJECT: Requirements of SPRS NIST SP 800-171, Not Applicable—

This memorandum is to document the contract file the requirements for Supplier Performance Risk

System (SPRS) National Institute of Standards and Technology (NIST) Special Publication (SP)

800-171 verification in accordance with Subpart Department of the Air Force Federal Acquisition

Regulation Supplement (DAFFARS) 5304.73.

1. Defense Federal Acquisition Regulation Supplement (DFARS) 204.7303(b) states that prior to awarding a contract (or Task Order/Delivery Order) or prior to the exercise of an option period or extending the period of performance (thereof), the Contracting Officer shall comply with and or verify the following:

a. In accordance with (IAW) DFARS 252.204-7012, the contractor shall provide adequate security on contractor covered information systems, which is defined as an unclassified information system owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information. “Covered defense information” is defined as unclassified controlled technical information or other information, as described in the Controlled Unclassified

Information (CUI) Registry.

b. IAW DFARS provision 252.204-7019, to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment no more than

3-years old for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. Under DFARS 252.204-7019(d)(1)(i)(F), the offeror shall meet a minimum score of 110 on their NIST SP 800-171 assessment.

c. IAW DFARS clause 252.204-7020, the offer shall comply with NIST SP 800-171 IAW

DFARS clause 252.204-7012, which applies to covered contractor information systems.

2. 502 CONS/JBKAB has confirmed with:

a. DCMA that if the contractor will not have any CUI (Controlled Unclassified Information) via the contractor-owned computer system and does not plan to have any CUI transferred to a

Government-owned system, then the requirements of the NIST would not apply. The clause would present, but not applicable nor effective. Furthermore, DCMA stated that DFARS clause 252.204-

7012 is applicable if the Government sends CUI to the contractor.

b. DAU Cyber Security Professor, Ms. Kelley Kiernan, stated that the contract document itself (including SOW, PWS, etc.) is not considered CUI unless specifically identified otherwise by the CO within the contract instrument.

3. The Contracting Officer has confirmed that CUI will not be sent to nor received by the subject contractor via the subject contract action. Based on the information herein, it is determined that the requirements of SPRS NIST SP 800-171, although effective by regulation, are not applicable.

SrA William Waters

502 CONS/JBKAB, Contracting Officer

CONTRACTOR’S ACKNOWLEDGEMENT OF RECEIPT:

TO: 502 CONS/JBKAB

Contractor confirms there is no covered defense information on the contractor covered information system(s), as defined under DFARS 252.204-7012. In general, this implies there is no unclassified controlled technical information or other information, described as Controlled Unclassified

Information (CUI), related data process, stored, transmitted by the contractor on the contractor’s computer system(s).

Company Name

Recipient’s Name & Title

Recipient’s Signature & Date