Cybersecurity and Controlled Unclassified Information (CUI) Safeguarding

The contract requires the implementation of NIST SP 800-171 security controls to safeguard Controlled Unclassified Information (CUI) in accordance with DFARS 252.204-7012 requirements, ensuring that all necessary technical, administrative, and physical safeguards are in place to protect CUI from unauthorized access, disclosure, or compromise. This includes the development of a comprehensive System Security Plan (SSP) that documents the implementation of each control, as well as a Plan of Action and Milestones (POA&M) to track and remediate any identified security gaps or deficiencies, with ongoing maintenance to sustain continuous compliance. The subcontractor must also establish processes for promptly detecting, reporting, and responding to cyber incidents involving CUI as mandated by the regulation. Performance is to be carried out at Tinker Air Force Base with a zip code of 73145-8000, under the oversight of the Department of Defense's ASC SUPPLIER OPER OEM DIVISION. The solicitation, classified under NAICS code 541512 for Information Technology Services, is issued as a subcontract opportunity with a response deadline of July 22, 2026. Compliance with all cybersecurity and CUI protection standards is non-negotiable, and the successful bidder must demonstrate proven capability in executing NIST controls, preparing documentation, and maintaining compliance in a government-contracted environment.