CUI Cybersecurity Compliance & NIST SP 800-171 Assessment Support

The contract requires comprehensive support for achieving and maintaining compliance with NIST SP 800-171 for the protection of Controlled Unclassified Information (CUI) within a DoD supplier environment. This includes the development and maintenance of a formal System Security Plan (SSP), conducting a thorough self-assessment of security controls, and ensuring full readiness for government-led Medium or High level assessments under DFARS 252.204-7020 requirements. The work is focused on aligning systems and procedures with the 110 security controls outlined in NIST SP 800-171 to meet federal cybersecurity standards and enable successful audits by government entities. Performance is expected to be carried out at Tracy, California, with a response deadline of May 20, 2026, under a subcontract arrangement tied to the NAICS code 541512 for computer systems design services. The contracting office is the ASC Supplier Oper OEM Division within the Department of Defense, and the effort is critical for sustaining eligibility to handle CUI as part of the DoD supply chain. Successful execution will ensure the prime contractor maintains compliance and operational authorization to support defense-related activities requiring secure information handling.