CUI and CDI Cybersecurity Compliance

The contract requires the implementation and ongoing maintenance of cybersecurity controls to safeguard Covered Defense Information and Controlled Unclassified Information in accordance with the standards outlined in NIST Special Publication 800-171. This subcontract is focused on ensuring compliance with federal cybersecurity requirements for handling sensitive unclassified data within the Department of Defense ecosystem, with all activities centered on the place of performance in Richmond, ZIP code 40475. The obligation includes establishing, monitoring, and updating technical, administrative, and physical safeguards to meet NIST 800-171 controls, ensuring continuous protection of information systems that process, store, or transmit CDI and CUI. The solicitation, posted on May 6, 2026, has a response deadline of June 2, 2026, at 6:00 p.m., and falls under NAICS code 541512 for Computer Systems Design Services. The contracting entity is the Department of Defense under the office designation W6QK Acc- Dta, and the work is classified as a subcontract rather than a prime award. There is no set-aside designation specified, meaning the opportunity is open to all qualified entities regardless of business size or status. Compliance with the cybersecurity framework is non-negotiable, and failure to meet the required controls could result in contract termination or liability for data breaches.