Controlled Unclassified Information (CUI) Cybersecurity Compliance

The contract requires the implementation and maintenance of NIST SP 800-171 security controls on all systems that handle contract-related Controlled Unclassified Information, ensuring full compliance with federal cybersecurity standards for protecting sensitive but unclassified data. The contractor must establish, document, and sustain the required controls to safeguard CUI throughout its lifecycle, including administrative, technical, and physical safeguards as specified in the NIST framework. A formal assessment of compliance must be submitted to the Department of Defense to validate that all security requirements have been properly executed and are being consistently maintained. This subcontract is issued under the MARITIME SUPPLY CHAIN division of the Department of Defense, with performance focused at the location in Tracy, California, with a postal code of 95304-5000. The solicitation falls under NAICS code 541512, indicating it relates to computer systems design services, suggesting the work involves configuring and securing IT infrastructure to meet CUI protection mandates. The response deadline is August 3, 2026, and the contract will be awarded as a subcontract, meaning the successful bidder will operate under a prime contractor’s agreement. Continued compliance and assessment submission are ongoing obligations, not one-time tasks, and failure to meet requirements may result in contract termination or loss of eligibility for future DOD work.