Controlled Unclassified Information (CUI) Security & Compliance

The contract requires the development and ongoing maintenance of a NIST SP 800-171-compliant System Security Plan tailored to handle Controlled Unclassified Information, ensuring adherence to federal security standards for DoD-related data. The contractor must support the preparation and submission of assessment documentation to meet DoD compliance requirements, demonstrating that security controls are properly implemented, monitored, and documented throughout the system lifecycle. This includes continuous alignment with NIST guidance to protect CUI in both digital and physical environments, with a focus on audit readiness and operational security posture. Performance is centered in Suffolk, Virginia, with a zip code of 23435-5000, and the work falls under NAICS code 541512, indicating information technology services and security consulting. The contract is structured as a subcontract under the Department of Defense’s Medical Supply Chain MD Surg FSF, with responses due by May 18, 2026. Timing and precision in delivering compliance artifacts are critical, as any lapse in documentation or control implementation could impact the organization’s ability to maintain authorized access to DoD information. The contractor is expected to provide sustained support beyond initial plan creation, including updates based on evolving regulatory guidance and internal audits.