Controlled Unclassified Information (CUI) Protection / Cybersecurity

The contract requires the implementation of robust cybersecurity safeguards to protect Controlled Unclassified Information (CUI) in accordance with DFARS 252.204-7012 and the National Institute of Standards and Technology Special Publication 800-171 standards. The contractor must develop and maintain a System Security Plan that details the controls and procedures for securing covered defense information throughout its lifecycle. Incident reporting obligations are mandatory, requiring prompt notification of any cybersecurity incidents affecting CUI, including details of the breach, impact, and remediation efforts. All required measures must be fully operational by the contract's performance start date, with continuous compliance ensured throughout the contract term. Performance is expected at Hill Air Force Base, Utah, with a response deadline of July 30, 2026, and the solicitation was posted on July 22, 2026. This is a subcontract under the Department of Defense, specifically managed by the ASC Commodities Division, and falls under NAICS code 541512 for computer systems design services. The contractor must demonstrate compliance with all NIST SP 800-171 security requirements and be prepared to provide documentation, including the System Security Plan and evidence of implemented safeguards, as part of contract validation and audit processes.