CUI Handling & IT Security Compliance

This contract requires the implementation and ongoing maintenance of NIST SP 800-171 controls to properly safeguard Controlled Unclassified Information within IT systems. Key responsibilities include system hardening to reduce vulnerabilities, strict access controls to limit CUI exposure to authorized personnel, comprehensive audit logging to track all relevant activities, and the secure destruction of CUI using methods approved by the National Security Agency. All work must be performed in compliance with federal standards for information security and is focused on ensuring the integrity, confidentiality, and availability of sensitive data handled by the contractor. The performance location is designated as Philadelphia, Pennsylvania, with the work falling under NAICS code 541690 for other scientific and technical consulting services. The contract is structured as a subcontract under the Department of Defense, specifically administered by the NSWC Philadelphia Division, and is open for responses until May 21, 2026. It mandates adherence to strict cybersecurity protocols and does not specify any set-aside status, indicating it is open to all eligible vendors. Contractors must be prepared to demonstrate full compliance with federal information security requirements and ensure that all processes for handling, storing, and disposing of CUI meet the highest standards as defined by NIST and NSA guidelines. The contract does not include a point of contact but provides a public SAM.gov link for additional details and submission materials.