Controlled Unclassified Information (CUI) Security Compliance (NIST SP 800-171)

The contract requires implementation and maintenance of NIST SP 800-171 cybersecurity controls across systems handling Controlled Unclassified Information, ensuring all technical, administrative, and physical safeguards are properly configured and operational. This includes conducting regular self-assessments to validate compliance with the standard and documenting any deviations or remediation efforts, with a strict requirement to flow down these cybersecurity obligations to any subcontractors whose work exceeds the simplified acquisition threshold. The effort is tied to systems operating at Fairchild AFB, with performance expectations aligned to Defense Logistics Agency directives under the Department of Defense, and must adhere to the NAICS code 541512 for computer systems design services. All activities must be completed within the specified window, with responses due by June 11, 2026, and the contract is structured as a subcontract under a broader DLA procurement. Compliance is non-negotiable, and failure to meet NIST SP 800-171 requirements or properly extend them downstream could result in contract noncompliance or termination. The work supports the broader DoD mandate to protect CUI across the defense industrial base, with ongoing monitoring and reporting expected as part of sustained operational security.