CUI Handling & Cybersecurity Compliance (NIST SP 800-171)

The contract requires the implementation and ongoing maintenance of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) and ensure full compliance with DFARS 252.204-7012. This subcontract is part of a Department of Defense initiative managed by the ASC SUPPLIER OPER OEM DIVISION, with performance centered in San Diego, California, under the NAICS code 541512 for computer systems design services. The contractor must establish and sustain cybersecurity measures that align with NIST standards to protect CUI throughout its lifecycle, including secure storage, transmission, and access controls, while also maintaining documentation and audit readiness to demonstrate compliance. The solicitation was posted on July 14, 2026, with responses due by July 22, 2026, underscoring a tight turnaround for proposers to demonstrate technical capability, security posture, and operational readiness. The place of performance is specific to San Diego, indicating that physical or on-site security infrastructure may be required, and the contract is not subject to any set-aside provisions. Success requires not only initial implementation of the required controls but also continuous monitoring, incident response protocols, and reporting mechanisms to meet federal cybersecurity obligations under the defense supply chain.