CUI Cybersecurity Compliance and Incident Reporting

The contract requires full implementation and ongoing maintenance of NIST SP 800-171 controls to protect Controlled Unclassified Information (CUI) within the contractor’s systems and processes. This includes establishing robust cybersecurity measures to safeguard CUI from unauthorized access, disclosure, or compromise, as well as ensuring timely and accurate incident reporting in the event of a breach or potential exposure. All subcontractors engaged under this agreement must also be required to comply with the same NIST SP 800-171 requirements through proper contractual flow-down clauses, ensuring end-to-end compliance across the supply chain. This is a small business set-aside subcontract under the SBA’s Total Small Business Set-Aside program, with a NAICS code of 541512 for computer systems design services, and is issued by the Department of Defense through DLA Dist San Joaquin. The place of performance is located in Tracy, California, with a zip code of 95304-5000. The solicitation was posted on August 5, 2026, and proposals are due by August 17, 2026. Participation is limited to small businesses meeting SBA size standards, and all work must align with federal cybersecurity requirements for handling CUI as mandated by federal regulations.