Contractor implementation of cybersecurity requirements have recently changed as Department of Defense Assessment Requirements will be placed in Defense Information Systems Agency contracts for information technology services. Vendors are now required to complete a self-assessment under the National Institute of Standards and Technology (NIST) standards.
DISA Head of Contracting Douglas W. Packard's letter, titled “Assessing Contractor Implementation of Cybersecurity Requirements, Supplier Performance Risk System (SPRS),” provides guidance in regard to contractor implementation of cybersecurity requirements and information on completing and submitting the assessment in the SPRS.