Controlled Unclassified Information (CUI) Cybersecurity Compliance

The contract requires full implementation of NIST SP 800-171 security controls to protect covered defense information, ensuring compliance with cybersecurity standards for handling Controlled Unclassified Information. This includes establishing robust safeguards for data integrity, confidentiality, and access control, as well as mandatory procedures for reporting cyber incidents and conducting periodic system assessments to validate ongoing compliance. The effort is scoped as a subcontract under a Total Small Business Set-Aside, reserved exclusively for small businesses as defined by the SBA, and is classified under NAICS code 541512 for computer systems design services. Performance must occur at the specified location in New Cumberland, Pennsylvania, with all deliverables aligned to Department of Defense requirements. The solicitation was posted on July 30, 2026, and responses are due by August 10, 2026, with the contracting activity originating from the Nuclear Reactor Program within the Department of Defense. The contract supports mission-critical infrastructure by enforcing federal cybersecurity frameworks for sensitive information, and failure to meet the prescribed controls could result in non-compliance penalties or termination. Bidders must demonstrate proven experience in NIST 800-171 implementation, incident response capabilities, and the ability to conduct authoritative system assessments, all while adhering to small business eligibility criteria. All work must be executed in accordance with FAR guidelines and the terms specified in the DIBBS bid portal.